Advertising Auctions Could Expose Starlink Users Without Hacking SpaceX

Starlink is designed to bring internet access to places where conventional networks are unavailable, unreliable or restricted. But satellite connectivity does not automatically guarantee privacy. A new investigation into digital advertising activity suggests that the infrastructure used to deliver ordinary advertisements may also create opportunities to track users across countries, including markets where Starlink faces restrictions.

The findings do not establish that Starlink devices were infected with spyware. They do, however, raise serious questions about how advertising data can expose people using a service that offers an alternative to conventional internet infrastructure.

An Unusual Advertising Pattern Emerges

Reuters reported that Israeli advertising company Discover-Tech was linked to an advertising entity identified by TrendAI as SHADOW-EARTH-79. According to six people familiar with the research, that name was TrendAI’s internal designation for Discover-Tech.

TrendAI found that the entity was the leading winning bidder for advertising impressions associated with Starlink traffic in 105 countries. Researchers considered the pattern consistent with targeted tracking infrastructure rather than an ordinary commercial advertising operation.

The findings are particularly significant because Discover-Tech had previously been connected to research into the delivery of commercial spyware through digital advertisements.

The Numbers Reveal an Unusual Concentration

TrendAI reported that SHADOW-EARTH-79 accounted for approximately 12.9% of winning advertisements in its Starlink sample, compared with 2.6% across general internet traffic. That represents nearly five times the baseline share.

The concentration was even more pronounced in individual markets.

• Argentina accounted for 91.3% of observed Starlink advertising wins attributed to the entity.

• The Philippines reached 89.1%.

• Japan reached 82.6%.

The entity was also the leading bidder in Syria, Libya, Yemen and South Sudan, and the second-largest bidder in Afghanistan.

These figures describe observed advertising auctions, not the percentage of Starlink users confirmed to have been tracked. Researchers have not publicly established that Starlink devices were infected as a result of this activity.

Billions of Bids Raise Questions About Commercial Motives

A separate analysis of approximately four billion advertising auction records from March through June 2026 found that Discover-Tech placed around 3.77 billion bids and won approximately 442 million auctions.

Its advertising scripts appeared across 75,373 Android and iOS applications and 120,768 websites.

The company spent approximately $109,000 during the period, with no recorded conversions. Researchers cited the absence of recorded conversions as further evidence that the activity did not resemble a conventional commercial advertising business.

The same investigation found that advertisements reached networks associated with NATO, the European Parliament, the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court.

These observations raise questions about the purpose of the activity, although the bidding data alone cannot establish the buyer’s intentions.

Previous Spyware Research Adds Context

On October 15, Citizen Lab published research connecting Discover-Tech with advertising associated with Candiru, an Israeli commercial spyware vendor that has since been rebranded as Integrity Labs.

Researchers identified at least 45 devices at Al Jazeera infected with Candiru spyware in 2024 and 2025. Network logs showed devices contacting Discover-Tech infrastructure when advertisements loaded, followed within seconds by communications with a Candiru validation server.

The investigation was described as the first public technical confirmation of commercial spyware delivered through targeted advertising without requiring user interaction.

In 2021, the US Department of Commerce added Candiru to its Entity List over concerns about surveillance technology supplied for use against journalists, activists and government officials.

Following the more recent investigation, Google told Citizen Lab that it had blocked Discover-Tech from bidding or serving advertisements across its advertising ecosystem. IAB Europe also removed the company from its Global Vendor List on October 8.

Real-Time Advertising Can Become a Tracking Mechanism

Digital advertising depends on automated auctions. When an advertising opportunity becomes available, information about the device, application, website and other contextual signals can be shared with participating bidders.

Depending on the data and identifiers involved, these signals can help buyers infer a device’s location or recognize activity associated with the same user over time.

That creates a potential surveillance pathway without requiring direct access to Starlink’s satellites or internal systems.

For users in countries where satellite internet is politically sensitive, location information could be particularly consequential. The original investigation noted that Starlink was among the tools used by Iranian citizens during anti-government protests in January, despite government efforts to restrict access.

The research suggests a possible way to identify or track some Starlink users. It does not prove that every user in the affected markets was monitored.

Open Connectivity Does Not Eliminate Privacy Risks

Starlink provides an alternative route to internet connectivity, but users still interact with websites, applications and advertising networks that operate independently of SpaceX.

This distinction matters for businesses, journalists, aid organizations and other groups operating in sensitive environments. A secure connection to the internet cannot prevent every third-party service from collecting information about the device using it.

The advertising ecosystem can therefore become a separate source of exposure, even when the underlying network has not been compromised.

The Business Model Behind Advertising Data Needs Scrutiny

Advertising technology creates value by matching audiences with commercial messages. Detailed targeting can improve campaign efficiency, but the same data flows can create risks when information is collected or used for purposes that users do not expect.

Discover-Tech’s reported bidding behavior illustrates why unusual patterns deserve investigation. Its extensive auction activity, low recorded spending and lack of recorded conversions differed from the usual commercial rationale for advertising purchases.

Still, unusual activity should be treated as a warning sign rather than definitive proof of a particular motive. Establishing intent requires evidence beyond auction statistics.

Businesses Should Treat Location Data as Sensitive

Companies do not need to operate in conflict zones to face these risks. Advertising identifiers, location signals and browsing activity can reveal employee behavior, customer interests and business operations.

Small and medium-sized businesses should review the advertising software installed on their websites and applications, minimize unnecessary tracking, and work with vendors that clearly explain their data practices.

Organizations handling sensitive information should also restrict access to location data, assess third-party software and avoid collecting information they do not need.

Privacy Is Becoming a Competitive Requirement

The Discover-Tech investigation highlights a broader weakness in the digital economy. Systems designed for commercial targeting can potentially be repurposed for surveillance, while the individuals generating the data may have little visibility into who receives it.

Starlink’s global reach makes the findings especially relevant, but the underlying issue extends well beyond satellite internet.

For businesses, the lesson is straightforward. Connectivity, advertising performance and digital growth cannot be evaluated separately from data protection. Companies that understand where their data goes, limit unnecessary collection and scrutinize third-party partners will be better positioned to protect customers and maintain trust.

Advertising Auctions Could Expose Starlink Users Without Hacking SpaceX

Starlink surveillance, Discover-Tech, digital advertising, Starlink privacy, location tracking, advertising auctions, spyware research, TrendAI findings, Citizen Lab, Candiru spyware, data privacy, satellite internet, advertising security, business cybersecurity