Israeli Spy Firm Exploits Starlink Ad Traffic for Global Surveillance
Malicious advertisements track Starlink users across 100 countries without requiring any user interaction.
1Large Scale Surveillance Campaign
An Israeli firm, identified as Discover-Tech, has been linked to a massive surveillance campaign targeting Starlink users. Research by Trend Micro’s TrendAI unit revealed that the company utilized malicious advertisements to harvest data. This operation spanned over 100 countries, raising significant concerns regarding the privacy and security of satellite internet users.
2Passive Data Collection Mechanism
The surveillance mechanism is highly sophisticated because it does not require users to click on any links. Simply serving the malicious advertisement to a browser or application initiates the data collection process. This passive approach allows the firm to create de-anonymized profiles of individuals without triggering any immediate user suspicion.
3Strategic Targeting of Conflict Zones
TrendAI researchers identified an obvious skew in advertising bids toward regions like Syria, Libya, Yemen, and South Sudan. These areas have virtually zero demand for legitimate Western commercial advertising. The firm’s status as the top bidder in these conflict-ridden zones strongly suggests a deliberate effort to monitor specific, high-risk user populations.
4Exploiting Satellite Network Vulnerabilities
Starlink terminals are designed to circumvent local internet restrictions, making them essential during blackouts or government-enforced shutdowns. However, this connectivity feature also makes them lucrative targets for entities seeking to track users. Since Starlink only provides the connection, third-party advertisements can still be injected into web traffic, creating a critical security gap.
5Previous Targeting of Journalists
Discover-Tech was previously linked to malicious advertising campaigns targeting Al Jazeera journalists earlier this month. This earlier exposure, documented by Citizen Lab, aligns with the tactics observed in the Starlink operation. The firm initially operated under the alias Shadow-Earth-79 before being identified as the primary perpetrator behind these intrusive digital activities.
6Platform Response and Mitigation
Following the exposure of these malicious activities, major advertising platforms have taken decisive action. Companies including Google and Comcast have officially removed Discover-Tech from their ad bidding platforms. These measures aim to prevent the firm from further abusing the digital advertising ecosystem to conduct unauthorized surveillance on global satellite internet users.
7Technical Implications for Privacy
The incident highlights a fundamental weakness in how advertising networks interact with satellite-based internet services. By manipulating the ad bidding process, malicious actors can bypass traditional network security layers. This creates a persistent threat where user data is harvested silently, regardless of the security protocols implemented by the internet service provider itself.
8Future Security Outlook
This campaign underscores the urgent need for stricter oversight in programmatic advertising. As satellite internet becomes more prevalent in restricted regions, the risk of surveillance through ad-tech will likely increase. Stakeholders must now prioritize developing robust defenses against non-click-based tracking to protect vulnerable users who rely on Starlink for their digital connectivity.