Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Researchers tie Discover-Tech ads to Starlink tracking

4 sources · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

TrendAI and Citizen Lab say Israeli firm Discover-Tech used ad auctions to track Starlink users and enable spyware; platforms removed it.

TrendAI, a Trend Micro unit, reported on October 15 that an operation it codenamed SHADOW-EARTH-79 dominated sampled real-time-bidding ads on Starlink network AS14593. Reuters sources identified the bidder as Israeli ad firm Discover-Tech; Citizen Lab and Confiant named the firm the same day. TrendAI said it took 12.9% of observed Starlink impressions versus 2.6% overall, led in 105 countries, and assessed the activity as surveillance at moderate to high confidence, without claiming every ad infected a device. Citizen Lab says Discover-Tech bridged ad vendors to mercenary spyware, including Candiru and Bindecy zero-click tools. Google and Comcast removed the firm; SpaceX and Discover-Tech did not comment.

Key facts
  • SHADOW-EARTH-79 took 12.9% of sampled Starlink impressions versus 2.6% overall.
  • It ranked first among observed Starlink bidders in 105 countries.
  • Researchers counted 66,208 Starlink impressions and 91.1% of Hungarian bids.
  • Analysis covered 84,710,348 requests from December 31, 2025, to August 15, 2026.
  • Citizen Lab says Candiru and Bindecy used Discover-Tech for zero-click spyware.
  • Google and Comcast removed the firm from their advertising platforms.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Dec 31, 2025TrendAI bid-request analysis window begins · GBHackers
  2. Aug 15, 2026Observed bid-request analysis window ends · GBHackers
  3. Oct 15, 2026TrendAI publishes unnamed SHADOW-EARTH-79 report · Security Affairs
  4. Oct 15, 2026Citizen Lab and Confiant name Discover-Tech · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsNames AS14593 and conflict-country ranking; ads do not prove infection.
  • DataBreaches.netCitizen Lab links Discover-Tech to Candiru and Bindecy spyware.
  • GBHackersAdds impression counts, country shares, request volume and JavaScript findings.
  • Security AffairsReuters sources tie the codename to Discover-Tech and note inquiries.
Vendors
Discover-TechSpaceX
Products
Starlink
Threat actors
CandiruBindecyDiscover-TechSHADOW-EARTH-79
Organizations
The Citizen LabUniversity of TorontoDiscover-TechTrendAITrend MicroCitizen LabConfiantGoogleComcast
Countries
IsraelSyriaLibyaYemenSouth SudanHungaryEgypt

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Cyber Security NewsFirst report

    Discover-Tech accused of tracking Starlink users through online ads

    TrendAI found one bidder dominating sampled Starlink ad auctions in 105 countries; the work does not show infection or a Starlink breach.

  2. · 3d ago DataBreaches.net

    Citizen Lab says spyware makers infect devices through online ads

    Researchers say Israeli firm Discover-Tech links ad vendors to Candiru and Bindecy zero-click spyware.

  3. · 2d ago GBHackers

    TrendAI says SHADOW-EARTH-79 used ad bidding to track Starlink users

    Researchers say the bidder led Starlink ad wins in 105 countries and bought 66,208 Starlink impressions, without confirming malicious code on every impression.

  4. · 2d ago Security Affairs

    Researchers say Discover-Tech ads may track Starlink users

    TrendAI says codename SHADOW-EARTH-79 won about 13% of observed Starlink ad bids and was the top bidder in 105 countries.