Threat reportThreat IntelligenceTL-2026-4690
Suspicious Ad-Bidding Targeting of Starlink Users by Discover-Tech (SHADOW-EARTH-79) — Possible Geolocation Surveillance
Suspicious Ad-Bidding Targeting of Starlink Users by (TL-2026-4690), also tracked as AdFection, is a medium-severity tracked intrusion set, first published 2026-10-29. It is attributed to Discover-Tech (Israel) with medium confidence, affects SpaceX Starlink consumer internet traffic (AS14593 address space), maps to 14 MITRE ATT&CK techniques (T1005, T1030, T1056.001), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 1Discover-Tech
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4690
- Threat ID
- TL-2026-4690
- Also known as
- AdFection, Invasive Ads
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Discover-Tech
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Israel
- Motivation
- UNKNOWN
- Target sectors
- news - media, government administration, military, critical infrastructure, international organizations, telecoms
- Target regions
- Middle East, Africa, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Suspicious Ad-Bidding Targeting of Starlink Users by
Malware and tooling: Candiru, DevilsTongue, shadow, Controlium
How Suspicious Ad-Bidding Targeting of Starlink Users by works
TrendAI (Trend Micro) reported that Israeli ad tech firm Discover-Tech, tracked as SHADOW-EARTH-79, won about 13% of bid events in observed Starlink traffic versus a ~3% baseline and was the top bidder on Starlink traffic in 105 countries, a pattern TrendAI assesses with moderate-to-high confidence as targeting and tracking infrastructure rather than commercial advertising. The same firm was separately exposed by Citizen Lab and Confiant (the 'AdFection' research) for delivering Candiru spyware to at least 45 Al Jazeera devices through real-time-bidding ads; no public source has shown that Starlink users were infected.
On 2026-10-15 TrendAI, the research unit of Trend Micro, published 'Invasive Ads: The Unconventional Cyber Surveillance Attack Surface'. TrendAI analysed advertising-network telemetry from a single demand-side platform covering 2025-12-31 to 2026-08-15 (228 days): about 84.7M captured requests, 8.4M buyer-attributed events, 6.4M served impressions, 154 buyer seats and 232 countries. The analysis extracted bidder identifiers, destination IPs, geolocated countries and ASNs from real-time-bidding (RTB) bid-request URLs and cross-referenced geolocation against Starlink's published geo-feed (SpaceX address space AS14593).
TrendAI designated the dominant bidder SHADOW-EARTH-79 and identified it as the Israeli ad tech firm Discover-Tech. It won roughly 13% of winning bid events in Starlink traffic against a ~3% baseline for other bidders (a 4.9x lift versus its overall footprint) and ranked first for Starlink traffic in 105 countries, including places where Starlink is banned or restricted or where demand for Western advertising is effectively nil (Syria, Libya, Yemen, South Sudan; second in Afghanistan). Near-monopoly overall shares were observed in Hungary (91.1%), Israel (90.1%), Egypt (77.2%), Azerbaijan (75.2%) and Venezuela (72.2%). TrendAI also recovered JavaScript bundles from open asset folders containing a platform's source tree, showing IP-handling and de-anonymisation functions, manual script injection and filtering of tracked individuals, features it describes as consistent with surveillance and intelligence gathering. Its assessment is that, with moderate-to-high confidence, the bidding is targeting and tracking infrastructure. The mechanism alleged is collating geolocated bid/impression data over time to locate and de-anonymise users.
On the same day Citizen Lab and Confiant published 'Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware'. Discover-Tech's Controlium platform lets customers target specific devices by IP address, cookie and mobile advertising ID. Ad script tags (on 120,768 websites and 75,373 apps) call a Discover-Tech 'NOAS' / 'getAd' server that evaluates the device's IP and ad identifiers; for most devices it returns no JavaScript, while selected targets receive additional code. The chain is: Discover-Tech ad server, then a Candiru screening server, then command-and-control. Citizen Lab linked, with high confidence, at least 45 Al Jazeera devices (2024-2025) to Candiru spyware delivered this way; ads were also observed on networks of organisations such as the US Department of Defense, IAEA and the ICC. Citizen Lab analysed about 3.77-4 billion bids from March to June 2026. Google removed Discover-Tech from its ad exchange; IAB Europe suspended it, Beeswax removed it, Vungle/Liftoff paused it and Eskimi blocked its accounts.
Evidence caveat: the Starlink finding is a bidding-pattern inference and allegation-level; no CVE, exploit or Starlink-user infection has been published. SpaceX did not comment and Discover-Tech did not respond to media or the researchers. The Starlink analysis and the confirmed Candiru delivery are linked only by the shared operator. Reuters reported on 2026-10-27 that attribution of the Starlink bidding to Discover-Tech was confirmed by six sources.
MITRE ATT&CK techniques used in TL-2026-4690
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
Exfiltration
T1030 Data Transfer Size Limits
Execution
Command and Control
T1071.001 Web Protocols; T1573 Encrypted Channel
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Resource Development
Reconnaissance
T1590.005 IP Addresses; T1592 Gather Victim Host Information
Affected products and versions in Suspicious Ad-Bidding Targeting of Starlink Users by
- SpaceX — Starlink consumer internet traffic (AS14593 address space)
Vulnerable versions: Ad-bid exposure observed in 105 countries; no product vulnerability - Programmatic advertising ecosystem — RTB exchanges, DSPs and ad-supported apps/websites
Vulnerable versions: Ads carrying Discover-Tech script tags on 120,768 websites and 75,373 apps
Fixed in: Google, Beeswax, IAB Europe, Vungle/Liftoff and Eskimi removed or paused Discover-Tech
Remediation for Suspicious Ad-Bidding Targeting of Starlink Users by
Immediate actions
- Block or sinkhole mtrtb.com at DNS/proxy and hunt historical logs for it
- Search proxy/DNS/EDR telemetry for contact with the recovered Candiru sample SHA-256
- Reset mobile advertising IDs and disable ad personalization on high-risk devices
- Enable device lockdown modes on devices of high-risk users
Workarounds
- Disable or restrict ad personalization and use ad-blocking on endpoints that handle sensitive work
- Avoid using Starlink-connected devices without ad filtering in sensitive contexts until the activity is clarified
Longer-term hardening
- Deploy DNS/web ad-blocking that intercepts ad-SDK and RTB backend traffic for high-risk users and sensitive networks
- Filter or restrict ad traffic in sensitive locations and apply least privilege to app permissions
- Ad-tech and DSP operators should review advertisers with similar bidding profiles and implausible geographic win patterns
- Keep browsers and OS patched; monitor for zero-click exploit activity
Timeline of Suspicious Ad-Bidding Targeting of Starlink Users by
- Discover-Tech, an Israeli digital advertising agency, founded in 2020 (year only reported); later listed as a Google-listed ad vendor.
- Al Jazeera's technical team begins noticing unusual device patterns; Citizen Lab later links at least 45 Al Jazeera devices to Candiru spyware delivered via Discover-Tech ads across 2024-2025 (month not reported).
- Start of the 228-day DSP telemetry window (through 2026-08-15) later analysed by TrendAI for RTB bidding patterns.
- Start of the March-June 2026 window in which Citizen Lab analysed ~3.77-4 billion Discover-Tech bids and 442 million auctions.
- Haaretz and Intelligence Online report on Israeli technology tracking Starlink users (as cited by Security Affairs).
- End of the TrendAI telemetry window covering 84.7M requests across 232 countries.
- Google terminates Discover-Tech's ad exchange access for systematically violating policies; IAB Europe suspends it; Beeswax removes it; Vungle/Liftoff pauses it; Eskimi blocks its accounts.
- TrendAI publishes 'Invasive Ads' naming SHADOW-EARTH-79; Citizen Lab and Confiant publish 'Exposing AdFection' tying Discover-Tech to Candiru zero-click delivery.
- Reuters (Raphael Satter) reports that six sources confirmed Discover-Tech is SHADOW-EARTH-79; SpaceX declines to comment and Discover-Tech does not respond.
- Security Affairs summarises the Starlink ad-bidding findings.
Sources cited for Suspicious Ad-Bidding Targeting of Starlink Users by
- Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users
- TrendAI: Invasive Ads: The Unconventional Cyber Surveillance Attack Surface
- Targeted ads installed Candiru spyware in zero-click attacks (BleepingComputer)
- Citizen Lab traces zero-click Candiru spyware delivered via Discover-Tech ads (The Hacker News)
- AdFection: Targeted Ads Delivered Candiru Spyware Without a Click (GridinSoft)
- Israeli ad-tech firm helped spy on Al Jazeera devices (Al Jazeera)
- Israeli firm used online ads to run vast spy operation, researchers say (Reuters via TimesLive)
- Israeli ad tech firm tied to suspected Starlink tracking effort (Tom's Hardware)
- Researchers Uncover Signs of Massive Surveillance Operation on Starlink Users (Gizmodo)
Detection coverage for TL-2026-4690
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4690 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.