A digital defense investigation has uncovered a massive surveillance campaign targeting Starlink users across more than 100 countries. Researchers from Trend Micro's AI cybersecurity unit, TrendAI, analyzed digital advertising data and concluded that an Israeli company named Discover-Tech operated the operation, which relied on malicious web advertisements to harvest user information.
The spying campaign exploited the digital advertising ecosystem by abusing ad-bidding mechanisms. Discover-Tech emerged as the leading bidder on Starlink advertising traffic, particularly in conflict zones and regions where internet access is heavily restricted or subject to government blackouts, such as Syria, Libya, Yemen, and South Sudan. Investigators noted an unusual concentration of ad-buying in these regions where traditional commercial demand is virtually non-existent.
The malicious mechanism did not require direct interaction from the target. Users did not need to click the advertisements for data collection to begin; simply loading a webpage that served the ad allowed the tracking scripts to harvest browser and application data. This automated data collection aimed to de-anonymize individuals utilizing satellite internet connections to bypass local restrictions, establishing digital profiles capable of fueling deeper intelligence operations.
Major technology corporations, including Google and Comcast, have taken action by removing Discover-Tech from their respective advertising platforms following the intelligence disclosures. The incident highlights how commercial programmatic advertising networks can be repurposed as vectors for state-level or corporate cyber espionage against satellite internet infrastructure.
Comments