Starlink Users May Have Been Tracked Through Online Ads, Researchers Warn

Starlink users may have been exposed to a large-scale tracking and surveillance effort through online advertising systems. An Israeli advertising technology company, Discover-Tech, was reportedly the leading bidder for ads shown to Starlink users in more than 100 countries.

What researchers found

TrendAI, a cybersecurity unit of Japan-based Trend Micro, analysed digital advertising data and found that Discover-Tech was among the biggest sources of ads directed at Starlink users. Reuters reports that researchers concluded that the company ranked first in ad bidding on Starlink traffic in more than 100 countries, including several where Starlink is banned or restricted.

The findings suggest the ads may have been used to identify users’ locations or monitor their online activity. However, the research does not establish that specific Starlink users were successfully identified, tracked, or infected with spyware.

How ad bidding can expose users

Online advertisements are commonly sold through automated, real-time auctions, where companies bid for space on websites and apps. Those bidding systems can transmit information such as a user’s approximate location, IP address, device type, and connection details to participating bidders.

Researchers said Discover-Tech allegedly abused this process. If such data is collected repeatedly and combined with other information, it could help de-anonymise users, follow their movements across the web, and potentially make them targets for surveillance software.

The company behind the activity

TrendAI published its report on October 15 but referred to the suspected actor only as 'Shadow-Earth-79'. The organisation said it used that approach to avoid premature attribution and prevent misleading or unstable labels from distorting security responses.

Reuters later reported, citing six people familiar with the investigation, that the codename referred to Discover-Tech. The company has previously been linked by separate investigations to advertising infrastructure connected with spyware delivery.

Separate investigations and platform action

On the same day TrendAI released its report, the University of Toronto’s Citizen Lab and New York-based advertising security firm Confiant separately named Discover-Tech. Their investigations alleged that the company used targeted advertising as a pipeline for surveillance and spyware-related activity.

Following those findings, Google, Comcast’s advertising technology business Beeswax, and other platforms said they removed Discover-Tech from their advertising systems. Google also terminated the firm’s access to its ad exchange platforms, while IAB Europe removed it from its approved vendor list.

What it means for users

The case highlights how ordinary advertising infrastructure can be repurposed for intelligence gathering without directly compromising a user’s account or device. Even routine ad auctions can leak signals that, when aggregated over time, may reveal patterns of movement and online behaviour.

For Starlink users, the reported activity is particularly concerning because the service can operate in remote areas and conflict-affected regions where conventional internet access is limited. Still, researchers have not confirmed that any individual subscriber was successfully located or surveilled, and neither Discover-Tech nor SpaceX has been reported as confirming the allegations.