# Suspicious Ad-Bidding Targeting of Starlink Users by Discover-Tech (SHADOW-EARTH-79) — Possible Geolocation Surveillance

> TrendAI (Trend Micro) reported that Israeli ad tech firm Discover-Tech, tracked as SHADOW-EARTH-79, won about 13% of bid events in observed Starlink traffic versus a ~3% baseline and was the top bidder on Starlink traffic in 105 countries, a pattern TrendAI assesses with moderate-to-high confidence as targeting and tracking infrastructure rather than commercial advertising. The same firm was separately exposed by Citizen Lab and Confiant (the 'AdFection' research) for delivering Candiru spyware to at least 45 Al Jazeera devices through real-time-bidding ads; no public source has shown that Starlink users were infected.

- **Published:** 2026-10-29T01:33:14Z
- **Last reviewed:** 2026-10-29T01:33:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4690
- **ID:** TL-2026-4690
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Discover-Tech (Israel)
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-15 TrendAI, the research unit of Trend Micro, published 'Invasive Ads: The Unconventional Cyber Surveillance Attack Surface'. TrendAI analysed advertising-network telemetry from a single demand-side platform covering 2025-12-31 to 2026-08-15 (228 days): about 84.7M captured requests, 8.4M buyer-attributed events, 6.4M served impressions, 154 buyer seats and 232 countries. The analysis extracted bidder identifiers, destination IPs, geolocated countries and ASNs from real-time-bidding (RTB) bid-request URLs and cross-referenced geolocation against Starlink's published geo-feed (SpaceX address space AS14593).

TrendAI designated the dominant bidder SHADOW-EARTH-79 and identified it as the Israeli ad tech firm Discover-Tech. It won roughly 13% of winning bid events in Starlink traffic against a ~3% baseline for other bidders (a 4.9x lift versus its overall footprint) and ranked first for Starlink traffic in 105 countries, including places where Starlink is banned or restricted or where demand for Western advertising is effectively nil (Syria, Libya, Yemen, South Sudan; second in Afghanistan). Near-monopoly overall shares were observed in Hungary (91.1%), Israel (90.1%), Egypt (77.2%), Azerbaijan (75.2%) and Venezuela (72.2%). TrendAI also recovered JavaScript bundles from open asset folders containing a platform's source tree, showing IP-handling and de-anonymisation functions, manual script injection and filtering of tracked individuals, features it describes as consistent with surveillance and intelligence gathering. Its assessment is that, with moderate-to-high confidence, the bidding is targeting and tracking infrastructure. The mechanism alleged is collating geolocated bid/impression data over time to locate and de-anonymise users.

On the same day Citizen Lab and Confiant published 'Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware'. Discover-Tech's Controlium platform lets customers target specific devices by IP address, cookie and mobile advertising ID. Ad script tags (on 120,768 websites and 75,373 apps) call a Discover-Tech 'NOAS' / 'getAd' server that evaluates the device's IP and ad identifiers; for most devices it returns no JavaScript, while selected targets receive additional code. The chain is: Discover-Tech ad server, then a Candiru screening server, then command-and-control. Citizen Lab linked, with high confidence, at least 45 Al Jazeera devices (2024-2025) to Candiru spyware delivered this way; ads were also observed on networks of organisations such as the US Department of Defense, IAEA and the ICC. Citizen Lab analysed about 3.77-4 billion bids from March to June 2026. Google removed Discover-Tech from its ad exchange; IAB Europe suspended it, Beeswax removed it, Vungle/Liftoff paused it and Eskimi blocked its accounts.

Evidence caveat: the Starlink finding is a bidding-pattern inference and allegation-level; no CVE, exploit or Starlink-user infection has been published. SpaceX did not comment and Discover-Tech did not respond to media or the researchers. The Starlink analysis and the confirmed Candiru delivery are linked only by the shared operator. Reuters reported on 2026-10-27 that attribution of the Starlink bidding to Discover-Tech was confirmed by six sources.

## MITRE ATT&CK

- T1590.005 IP Addresses
- T1592 Gather Victim Host Information
- T1583.008 Malvertising
- T1059.007 JavaScript
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1030 Data Transfer Size Limits

## Sources

- [Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users](https://securityaffairs.com/201947/intelligence/ads-or-surveillance-researchers-flag-suspicious-targeting-of-starlink-users.html)
- [TrendAI: Invasive Ads: The Unconventional Cyber Surveillance Attack Surface](https://www.trendaisecurity.com/en-us/resources-insights/deep-research/invasive-ads-the-unconventional-cyber-surveillance-attack-surface)
- [Targeted ads installed Candiru spyware in zero-click attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/)
- [Citizen Lab traces zero-click Candiru spyware delivered via Discover-Tech ads (The Hacker News)](https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html)
- [AdFection: Targeted Ads Delivered Candiru Spyware Without a Click (GridinSoft)](https://blog.gridinsoft.com/adfection-targeted-ads-candiru-spyware/)
- [Israeli ad-tech firm helped spy on Al Jazeera devices (Al Jazeera)](https://www.aljazeera.com/amp/news/2026/10/15/israeli-ad-tech-firm-helped-spy-on-al-jazeera-devices)
- [Israeli firm used online ads to run vast spy operation, researchers say (Reuters via TimesLive)](https://www.timeslive.co.za/news/2026-10-15-israeli-firm-used-online-ads-to-run-vast-spy-operation-researchers-say/)
- [Israeli ad tech firm tied to suspected Starlink tracking effort (Tom's Hardware)](https://www.tomshardware.com/tech-industry/cyber-security/israeli-ad-tech-firm-tied-to-suspected-starlink-tracking-effort-report-claims-researchers-say-it-outbid-everyone-for-starlink-linked-ads-in-100-countries-including-where-the-service-is-banned)
- [Researchers Uncover Signs of Massive Surveillance Operation on Starlink Users (Gizmodo)](https://gizmodo.com/researchers-uncover-signs-of-massive-surveillance-operation-on-starlink-users-2000831366)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4690