Discover-Tech, Firm Tied to Candiru Spyware, Tops Starlink Ad Bids

Discover-Tech, an Israeli advertising firm previously tied to the delivery of zero-click spyware, is the top bidder for Starlink ad impressions in 105 countries, according to a Reuters report. Researchers say the pattern points to a large-scale effort to track users of SpaceX's satellite internet service.

John Scott-Railton, a senior researcher at Citizen Lab at the University of Toronto, said data from TrendAI suggest a "worldwide surveillance op targeting @Starlink users."

What the data show

TrendAI examined advertising telemetry and labeled the entity SHADOW-EARTH-79. It accounted for about 12.9% of winning ads in its Starlink sample, against a 2.6% baseline across general traffic, a nearly fivefold over-representation. It captured 91.3% of observed Starlink wins in Argentina, 89.1% in the Philippines and 82.6% in Japan. It also ranked first in Syria, Libya, Yemen and South Sudan, and second in Afghanistan, markets where TrendAI said demand for legitimate Western advertising is effectively zero.

TrendAI concluded with moderate-to-high confidence that the bidding looked like "targeting and tracking infrastructure rather than a commercial advertising operation." Reuters, citing six people familiar with the research, reported that SHADOW-EARTH-79 is TrendAI's internal codename for Discover-Tech. TrendAI reportedly left the name out of its October 15 report after executives raised legal concerns.

The Candiru connection

On the same day, Citizen Lab reported that Discover-Tech bought ordinary-looking ads that delivered Candiru spyware to devices at Al Jazeera with no user interaction. The group identified at least 45 infected devices in 2024 and 2025. Candiru, now rebranded as Integrity Labs, has been on the U.S. Entity List since 2021.

Discover-Tech held certified or approved vendor status with Google and IAB Europe from 2020 until this month. Google has since cut its access to its ad exchange platforms, and IAB Europe removed it from its Global Vendor List on October 8.

Researchers have not publicly confirmed any infections of Starlink devices. But real-time ad bidding shares device and location data with every participating buyer, which could allow tracking without compromising Starlink's own infrastructure. That matters most in countries that restrict Starlink, where users may face government scrutiny for using it.