Israeli company tracked Starlink users via ads

Researchers found that an Israeli company, identified as Shadow-Earth-79 in a report by TrendAI, used online advertisements to locate and monitor Starlink users in over 100 countries. The company bid heavily to display its ads on devices connected via Starlink, allowing it to collect data on users' locations and browsing habits without any interaction from the user.

Ads reveal user data without clicks

When a website or app loads an advertisement, multiple buyers compete to display their ads in a fraction of a second. This process can transmit information like the user's IP address, device type, approximate location, and advertising identifiers. Shadow-Earth-79 paid more for ads coming from Starlink, enabling it to track users' locations and habits by cross-referencing the data.

Company linked to spyware and surveillance

The company, later identified as Discover-Tech, was involved in a broader surveillance operation that used ads to detect users and install spyware like Candiru. This method allows spying to occur without any user action—simply loading an ad can trigger the surveillance of a targeted device.

Focus on conflict and sanctioned regions

The activity was most intense in countries like Syria, Libya, Yemen, South Sudan, and Afghanistan, which are either in conflict or under international sanctions. These areas have limited advertising revenue, leading researchers to describe the operation as a targeting and tracking infrastructure rather than a typical commercial ad campaign.

Widespread ad distribution and platform bans

Discover-Tech's ads appeared on more than 120,000 websites and 75,000 apps, with at least ten million ads shown daily. This exposure could have affected hundreds of millions of people. The company’s ads also appeared on devices connected to networks used by NATO, the Pentagon, the UN, and European institutions, prompting Google, Comcast, and others to ban it from their platforms.

Al Jazeera employees targeted by spyware

Between 2024 and 2025, at least forty-five devices used by Al Jazeera employees were targeted by Candiru spyware. The publisher of Candiru was placed on a U.S. Commerce Department blacklist over allegations of spying on journalists, activists, and academics. Two unnamed major U.S. technology companies and an international organization have launched internal investigations into whether their employees were targeted. SpaceX, Discover-Tech, and its CEO have not responded to media requests for comment.