An advertising firm previously connected to the delivery of zero-click mercenary spyware emerged as the top bidder for ad impressions on Starlink satellite traffic across 105 countries. Security researchers warn the anomaly points to a widespread tracking and surveillance operation targeting users of SpaceX's internet service.
The findings stem from parallel investigations by Citizen Lab and ad security firm Confiant, alongside analysis from TrendAI regarding an entity internally tracked as SHADOW-EARTH-79. Reuters later reported that sources familiar with the matter identified this entity as Discover-Tech, an Israeli firm previously exposed for delivering Candiru spyware to devices at Al Jazeera without user interaction. Discover-Tech operated as a certified vendor with Google and IAB Europe before both platforms terminated its access in October following the initial disclosures.
TrendAI data showed the entity accounted for roughly 12.9 percent of winning advertisements on Starlink traffic, representing a nearly fivefold over-representation compared to general web traffic. The skew appeared heavily concentrated in politically sensitive or restricted regions, including Argentina, the Philippines, Japan, Syria, and Venezuela. Analysts noted that the firm spent over $100,000 during a three-month period with zero recorded conversions, heavily discounting any legitimate commercial advertising intent.
While researchers have not publicly confirmed direct malware infections on Starlink terminals, the infrastructure mirrors methods previously used to deploy commercial spyware tools against journalists and activists. The targeted bidding strategy gives operators unusual visibility into satellite internet users, particularly in regions where accessing Western connectivity carries significant legal and political risks.
Comments