Israeli Ad Tech Firm Linked to Suspected Starlink Tracking Campaign

Background on Discover Tech and the investigation

In early 2024, two independent research groups released reports that tied an Israeli ad tech company called Discover Tech to a large scale online advertising operation. The operation appeared to target users who accessed services related to satellite internet, particularly those linked to Starlink. The researchers described the activity as a possible method of surveillance rather than a conventional marketing effort.

Who conducted the research

The first report came from Citizen Lab, a research lab at the University of Toronto that specializes in digital threats. The second analysis was published by Confiant, a firm that monitors ad fraud and malicious code in the advertising ecosystem. Both groups examined the same set of ad placements and reached similar conclusions.

Scope of the ad placements

According to the reports, the ads associated with Discover Tech were delivered through an extensive network of nearly 200,000 websites and mobile applications. The network spanned news sites, entertainment portals, and free apps that rely on ad revenue. The sheer volume of impressions suggested a coordinated effort that went beyond ordinary ad campaigns.

Key observations

Ads were served to users who visited pages about satellite broadband.
Placement patterns matched known data collection techniques used by state actors.
There was no direct evidence that the ads installed malware, but the targeting raised suspicion.

TrendAI’s codename and additional findings

Separately, a security analytics firm called TrendAI identified the same activity under the internal codename “SHADOW EARTH 79”. TrendAI’s analysis focused on the technical signatures of the ad requests, noting that the payloads often contained invisible tracking pixels and scripts that could collect device identifiers.

Technical details

Requests were routed through third‑party ad exchanges that obscure the original source.
Scripts executed in the browser could read browser fingerprints and transmit them to a central server.
The data flow appeared to be encrypted, making network interception difficult.

Why ad auctions matter for surveillance

Online ad auctions work by allowing advertisers to bid for the right to display an ad to a specific user in real time. When a user visits a page, the ad exchange evaluates the bid and serves the highest‑paying ad. This process creates a momentary link between the user’s device and the advertiser’s server. Researchers argue that malicious actors can exploit this link to embed tracking code without the user’s knowledge.

Potential privacy implications

Users could be profiled across multiple platforms without consent.
Data collected may be combined with other sources to create detailed dossiers.
Targeted ads could be used to deliver disinformation or influence opinions.

Regulatory perspective

Authorities in several jurisdictions have begun to scrutinize the use of ad tech for covert tracking. The Federal Trade Commission has issued guidance that requires clear disclosure when data is collected for advertising purposes. In the European Union, the General Data Protection Regulation imposes strict consent requirements for any processing of personal data.

Industry response

Major ad platforms such as Google and Meta have publicly stated that they monitor for malicious activity and remove actors that violate policy. However, the reports highlight the difficulty of policing a system that relies on automated bidding and real‑time decision making.

Steps platforms claim to take

Continuous scanning of ad creatives for hidden code.
Automatic suspension of accounts that breach policy.
Collaboration with external researchers to share threat intelligence.

What users can do to protect themselves

While technical safeguards are largely in the hands of platforms, individuals can adopt practices that reduce exposure to covert tracking. Using privacy‑focused browsers, blocking third‑party cookies, and installing reputable ad blockers are common recommendations.

Practical tips

Enable tracking protection in browser settings.
Regularly clear browsing data and cache.
Consider a virtual private network when accessing sensitive services.

Broader implications for the ad tech ecosystem

The Discover Tech case underscores a growing tension between the economic model of free content supported by advertising and the need for robust privacy safeguards. If ad auctions can be weaponized, the trust that underpins the entire digital advertising market could erode.

Advocacy groups such as the Electronic Frontier Foundation argue that stronger transparency requirements and independent audits are essential to prevent abuse. Policymakers may need to consider new legislation that specifically addresses the intersection of ad technology and surveillance.

As the investigation continues, the technology community will be watching to see whether additional evidence emerges that links ad impressions to more invasive forms of monitoring. For now, the findings serve as a reminder that the line between advertising and surveillance can be thin, and that vigilance is required from researchers, regulators, and users alike.