Researchers say Discover-Tech ads may track Starlink users
TrendAI says codename SHADOW-EARTH-79 won about 13% of observed Starlink ad bids and was the top bidder in 105 countries.
58
Organization
Confiant
- Mentions · 7d2
- Mentions · 30d9
- All mentions10
- First seenSep 7, 2026
- Last mentioned2d ago
Timeline
10 articles · newest firstDiscover-Tech accused of tracking Starlink users through online ads
TrendAI found one bidder dominating sampled Starlink ad auctions in 105 countries; the work does not show infection or a Starlink breach.
62
Senators cite ad-delivered spyware; ad groups defend vetting
Citizen Lab's AdFection report says Discover-Tech ads carried zero-click mercenary spyware, including impressions on government networks.
72
Zero-click spyware infecting devices through online ads, researchers say
Citizen Lab says Candiru used Discover-Tech ads to zero-click infect Al Jazeera journalists and reach sensitive government networks.
78
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Citizen Lab says Candiru spyware hit at least 45 Al Jazeera devices via zero-click ads.
82
AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks
Citizen Lab says Candiru used Discover-Tech ads for zero-click spyware, hitting at least 45 Al Jazeera devices.
82
Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
Citizen Lab says Candiru and Bindecy used Discover-Tech ads to deliver zero-click spyware, including against Al Jazeera.
82
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
Citizen Lab says Candiru spyware infected Al Jazeera phones through zero-click ads placed by Discover-Tech.
78
AdFection: How mercenary spyware invades victims’ devices through targeted advertising
Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware, infecting Al Jazeera devices.
80
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.
45
Appears with
- Citizen Laborganization · 8
- Googleorganization · 6
- Discover-Techorganization · 6
- Googlevendor · 6
- Candiruthreat actor · 6
- Al Jazeeravictim · 6
- IAB Europeorganization · 5
- Candirumalware · 4
- Al Jazeeraorganization · 4
- Controliumproduct · 4
- NATOorganization · 3
- Beeswaxorganization · 3
- International Atomic Energy Agencyorganization · 3
- Discover-Techthreat actor · 3
- Dark Cartographerthreat actor · 2
- Starlinkproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.