TrendAI says SHADOW-EARTH-79 used ad bidding to track Starlink users
Original title: Hackers Abuse Online Ads to Track Starlink Users and Spy on Individuals Across 49 Countries
Researchers say the bidder led Starlink ad wins in 105 countries and bought 66,208 Starlink impressions, without confirming malicious code on every impression.
TrendAI describes an operation it calls SHADOW-EARTH-79 that bought real-time-bidding ads, with unusual concentration on Starlink traffic, and assesses it as surveillance infrastructure at moderate to high confidence. Bid requests can expose IP addresses, geolocation, autonomous system numbers and device traits; winning ads may deliver JavaScript. The group led overall winning bids in 49 countries and captured large shares in Hungary, Israel and Egypt. Visibility was limited to one demand-side platform, and researchers do not claim every impression compromised a device.
Unconfirmed: TrendAI rates the surveillance assessment moderate to high confidence; it does not confirm malicious code on every impression or victim counts, and one demand-side platform plus IP geolocation limits the view.
- The operation bought 66,208 Starlink impressions, 12.9% of observed Starlink ads versus a 2.6% baseline.
- It captured 91.1% of observed bids in Hungary, 90.1% in Israel and 77.2% in Egypt.
- Analysis covered 84,710,348 requests from December 31, 2025, to August 15, 2026.
- Recovered JavaScript suggested manual script injection, de-anonymization and advanced IP filtering.
Impact: Behavioral profiles from ad bid data and possible JavaScript collection
- 1.Restrict advertising traffic on sensitive devices and networks and limit ad-supported apps.
- 2.Disable ad personalization, review app permissions and reset advertising identifiers.
- 3.Block connections to advertising backends and identified surveillance infrastructure.
- Products
- Starlink
- Threat actors
- SHADOW-EARTH-79
- Organizations
- TrendAI
From the original article
3 min read at gbhackers.com
Advertising infrastructure is increasingly being repurposed as a surveillance channel that can profile internet users and track their movements across sensitive locations, according to research from TrendAI.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.