Reuters reported on October 27, 2026, from Washington that six people familiar with the matter identified an Israeli ad tech company, Discover-Tech, as one of the largest sources of digital ads shown to Starlink users. Researchers at TrendAI, a unit of Tokyo-based cybersecurity firm Trend Micro, had flagged the pattern under a codename. Reuters said the ads were likely a way to geolocate or surveil the people who saw them.
That last point is the hard part of this story. The bidding activity is documented in TrendAI’s research. The surveillance purpose is an allegation, and nobody has publicly proven it. This analysis separates the two, lays out the numbers that exist, and explains why a story about ad auctions belongs in a hardware conversation about satellite internet terminals.
Starlink users are not a typical ad audience. Many sit in places with few other connectivity options, from conflict zones to remote regions, and the dependence on one provider has been a recurring worry. We covered that angle earlier in our look at Ukraine’s single-vendor Starlink risk. A campaign that concentrates on those users, in more than 100 countries, raises fresh questions about who can see them online.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Reuters Reported About Discover-Tech and Starlink Users
The Reuters exclusive rests on two layers. The first is public: TrendAI published a report on October 15 about the targeting of Starlink users. That report did not name Discover-Tech. It described the party responsible as “an ad tech entity” and gave it the codename “Shadow-Earth-79.”
The second layer is Reuters’ own sourcing. Six people familiar with the matter told the news agency that Shadow-Earth-79 is TrendAI’s codename for Discover-Tech. Those same sources said the company was among the largest providers of ads shown to Starlink users. SpaceX operates the Starlink service.
Reuters’ headline called the company an alleged Israeli spy firm. Reuters’ own framing hedges that label. The available reporting identifies Discover-Tech as an Israeli ad tech company, and the claim that it used its ad buying to spy on, geolocate or surveil users is presented as the likely purpose, not an established fact. Regional outlets including The News International and The Jerusalem Post also carried the story, both keeping the allegation framing.
The excerpts of the Reuters report available at the time of writing do not carry a response from Discover-Tech or SpaceX. We will treat that silence as unresolved rather than as an admission or a denial.
The TrendAI Report and the Shadow-Earth-79 Codename
TrendAI is the research arm inside Trend Micro, a company with a long record in threat intelligence. Its October 15 report is where the quantitative claims come from. The researchers did not publish a company name. They tracked an entity by its bidding behavior, labeled it Shadow-Earth-79, and described an “obvious skew” toward buying advertisements aimed at Starlink users.
Using a codename is standard practice in threat research. Analysts often group activity under a label first and attach a real-world identity later, once the evidence is strong enough. What makes this case unusual is that the identity link came from journalists’ sources, not from the researchers themselves. TrendAI has not confirmed that link in the material we reviewed.
That gap matters for how readers should weigh the story. The pattern in the bid data is a research finding. The Discover-Tech attribution is a sourced claim by six unnamed people. The spying purpose is an inference. Each layer carries less certainty than the one below it.
Where the Bidding Concentrated: Country-by-Country Findings
The geographic pattern is what drew attention. According to TrendAI’s report, Shadow-Earth-79 was the top ad buyer in Syria, Libya, Yemen and South Sudan, and the No. 2 ad buyer in Afghanistan. In five other countries it won what the report calls “an implausibly dominant share” of bids. The table below sets out those findings.
| Country | TrendAI finding for Shadow-Earth-79 | Source |
|---|---|---|
| Syria | Top ad buyer | TrendAI report, via Reuters |
| Libya | Top ad buyer | TrendAI report, via Reuters |
| Yemen | Top ad buyer | TrendAI report, via Reuters |
| South Sudan | Top ad buyer | TrendAI report, via Reuters |
| Afghanistan | No. 2 ad buyer | TrendAI report, via Reuters |
| Hungary | Implausibly dominant share of bids | TrendAI report, via Reuters |
| Israel | Implausibly dominant share of bids | TrendAI report, via Reuters |
| Egypt | Implausibly dominant share of bids | TrendAI report, via Reuters |
| Azerbaijan | Implausibly dominant share of bids | TrendAI report, via Reuters |
| Venezuela | Implausibly dominant share of bids | TrendAI report, via Reuters |
Look at the first group. Syria, Libya, Yemen and South Sudan are places where commercial advertisers rarely compete hard for audiences. A buyer that tops those markets is not chasing consumer sales in any normal sense. The inclusion of Israel itself in the second group is also worth a second look, since it undercuts any simple reading of the activity as aimed only at foreign adversaries.
What TrendAI’s Own Numbers Say: Three Verified Statements
Beyond the country list, the full TrendAI research paper, titled Invasive Ads: The Unconventional Cyber Surveillance Attack Surface, gives three headline figures. We quote them directly below, since the exact wording matters.
“SHADOW-EARTH-79 was the number-one bidder in 105 countries for observed Starlink traffic.”
TrendAI, 2026 research paper
“SHADOW-EARTH-79 accounted for approximately 13% of all winning bid events in observed Starlink traffic.”
TrendAI, 2026 research paper
“SHADOW-EARTH-79’s approximately 13% share of winning Starlink-traffic bids was about five times the approximately 3% average for other bidders.”
TrendAI, 2026 research paper
The arithmetic here is simple but telling. A 13% share of winning bids would be unremarkable for a large mainstream advertiser. It looks different when set against a roughly 3% average for other bidders. A single entity winning about five times the typical share, while also ranking first in 105 countries, is the sort of outlier that prompted the “obvious skew” language.
| Metric | Shadow-Earth-79 | Typical other bidder |
|---|---|---|
| Countries ranked No. 1 in observed Starlink traffic | 105 | Not reported |
| Share of winning bid events | About 13% | About 3% average |
| Multiple of average share | About 5x | 1x baseline |
| Countries covered by the activity (Reuters) | More than 100 | Not applicable |
| Report publication date | October 15, 2026 | Not applicable |
How Ad Bidding Could Turn Into Tracking
To see why researchers treat ad buying as a possible surveillance channel, it helps to understand the plumbing. Most web and app ads are sold through automated auctions that run in a fraction of a second. When a page loads, the publisher’s system sends out a bid request describing the viewer and the slot. Buyers respond with bids, and the highest one wins the right to show an ad.
What a Bid Request Typically Carries
A bid request often includes technical details about the device and connection. Depending on the app or site, it can also include broad location hints or identifiers. A buyer does not need to win the auction to read that data. Even a losing bidder sees the request. A buyer that wins gets a second advantage: the chance to serve an ad that loads content from its own servers, which can reveal more about the device that requested it.
This is why security researchers have long described the ad ecosystem as an unconventional attack surface. The TrendAI paper’s title makes the same point. The mechanism requires no malware on a phone and no breach of a network. It rides on infrastructure that billions of people already use every day.
Why Satellite Internet Users Stand Out
Starlink traffic is easy to tell apart from other connections, because it arrives from network ranges tied to the service. An auction participant can therefore filter for Starlink users and bid only on them. That is consistent with the “obvious skew” TrendAI described. It also means a buyer interested in a specific population, such as people using Starlink in a conflict area, can build an audience without asking anyone’s permission.
Whether a bid or an ad impression can pin a person to a street address is a separate question, and the reporting does not answer it. Reuters described geolocation as the likely goal. It did not describe a proven technique, a number of affected people, or any individual who was found as a result. Treat claims that go further than that with caution.
Confirmed, Alleged, and Unproven: Sorting the Claims
Stories like this one spread fast, and the headline version tends to drift from the evidence. The table below keeps score. It uses only what the Reuters report and the TrendAI research state.
| Claim | Status | Basis |
|---|---|---|
| TrendAI published a report on October 15 about targeting of Starlink users | Confirmed | Reuters |
| The report used the codename Shadow-Earth-79 and did not name Discover-Tech | Confirmed | Reuters |
| Six sources say Shadow-Earth-79 is TrendAI’s codename for Discover-Tech | Reported by Reuters, sources unnamed | Six people familiar with the matter |
| Discover-Tech was among the largest sources of ads shown to Starlink users | Reported by Reuters, sources unnamed | Six people familiar with the matter |
| Bidding spans more than 100 countries | Reported | Reuters and TrendAI research |
| The ads were used to spy on, geolocate or surveil users | Unconfirmed allegation | Presented as likely purpose |
| Discover-Tech is a spy company | Unconfirmed | Identified in reports as an ad tech company |
| Specific victims, device data, user counts or spyware | Not stated | No such details in the reporting |
The last row deserves emphasis. No reporting we reviewed names a victim, counts affected users, or says spyware was deployed. If those details emerge later, the story changes. Today it is a pattern-and-suspicion story, not a documented-harm story.
Why Starlink Hardware Sits at the Center of This Story
The Starlink terminal is a piece of consumer hardware that does more than point at the sky. It becomes the single gateway for every device in a home, a camp or a vehicle. All of that traffic leaves through one provider’s network, and ad requests from every phone, laptop and smart TV behind the dish look alike from the outside.
That architecture creates a shared fingerprint. Terrestrial broadband in a dense city mixes millions of users across thousands of networks. A satellite service concentrates its users behind identifiable ranges, so a buyer can isolate them in an auction at almost no cost. The hardware choice, in other words, shapes the privacy profile of the people who rely on it.
For readers following the broader hardware market, our hardware coverage tracks how connectivity gear, dishes and AI chips are reshaping what consumers can buy and what they give up in return. The Starlink ad story adds a privacy dimension to a category usually judged on speed and price.
Who Is Most Exposed: The Regional Picture
The countries where Shadow-Earth-79 topped the rankings share a profile. Several are marked by conflict, fragile governance or limited terrestrial infrastructure. In those places a satellite dish is often the most dependable link to the outside world, and the people using it can include aid workers, journalists and local officials alongside ordinary households.
Access to the service is itself contested in many markets. When Starlink cut off users in one country over a licensing dispute, as we reported in our piece on South Africa’s 30% rule, customers learned how quickly a single provider’s decisions can reach the end user. An advertising channel that targets those same users adds a second, quieter dependency.
Hungary, Israel, Egypt, Azerbaijan and Venezuela, the second group in TrendAI’s findings, are a more mixed set. They differ widely in politics and market maturity. The shared feature was the unusual dominance of one buyer, which TrendAI judged implausible for ordinary commercial activity.
Market and Competitive Impact
No financial figures tie to this story, and we are not going to invent any. SpaceX is a private company, and neither the Reuters report nor TrendAI’s findings assign a revenue effect to the activity. The impact is reputational and regulatory, and it lands on three groups.
SpaceX and Starlink. The company did not run the ads, but its customers were the target. Expect pressure to explain what it can see, what it can block, and what controls it offers. Carriers weighing satellite partnerships will notice. Verizon has already ruled out a Starlink virtual network deal, a position we covered in our Verizon MVNO report, and privacy headlines will not make carrier conversations easier for SpaceX.
Rival satellite operators. Competitors preparing their own constellations get a talking point. Telesat’s Lightspeed network, which needs 14 SpaceX launches to reach 225 satellites, could try a privacy-first pitch to customers who care about exactly this sort of exposure, though no rival has made such a claim yet.
Ad exchanges and platforms. The companies that run the auctions face the sharpest questions. If one buyer can quietly win a disproportionate share of Starlink-origin traffic in 105 countries, then buyer vetting and traffic monitoring look thin. That is a compliance problem for every exchange that carried those bids.
Historical Context: Ads as a Surveillance Channel
Researchers and privacy advocates have warned about the surveillance potential of ad auctions for years. The core worry never changed: data created to sell ads can be repurposed by anyone who joins the auction. What changed is the scale of the infrastructure and the number of devices feeding it.
Big platforms have also been rewriting how they connect personal data to advertising. Our coverage of Google’s October 16 policy linking Gmail to ads shows how contested that line has become even among companies with direct consumer relationships. The Starlink case is different in kind, because the alleged buyer sits outside any relationship with the user at all.
The pattern TrendAI describes also fits a broader trend in which surveillance vendors look for cheap, deniable access to populations of interest. Buying ads is legal, widely available and leaves little forensic trace on the target’s device. That combination makes it attractive, and it makes attribution slow.
What Starlink Users Can Do Now
Nothing in the reporting says an individual user was compromised, and nothing demands panic. Still, reducing ad exposure is sensible hygiene for anyone who relies on satellite internet in a sensitive setting. These steps cut the signal that bid requests carry.
- Turn on DNS-level ad and tracker blocking at the router or on each device.
- Reset or disable the advertising identifier on phones and tablets.
- Use a browser with built-in tracker protection and keep extensions to a minimum.
- Route sensitive browsing through a trusted VPN, which hides the Starlink network range from ad exchanges.
- Review app permissions, especially location access for apps that show ads.
- Keep terminal firmware and device operating systems updated.
Journalists, aid workers and anyone working in the countries named above should treat this as a prompt to tighten their setup. Organizations with a security team should ask it to review how traffic leaves their sites.
What Regulators and SpaceX Could Do Next
The options split into three tracks. Regulators could demand transparency from ad exchanges about who bought what. SpaceX could add privacy features to the terminal or app. And the ad industry could adopt stricter buyer checks for traffic from sensitive networks.
None of these is announced. We found no statement from a regulator, from SpaceX or from an exchange in the reporting available today. The pressure may build slowly, since the legal status of the underlying activity is unclear. Buying ads is lawful in most places. Using the resulting data to track people is where laws usually apply, and proving that requires evidence nobody has shown publicly.
Five Predictions for the Weeks Ahead
These are our expectations as analysts. They are not reported facts, and any of them could prove wrong.
- Discover-Tech will dispute the framing. Expect the company, if it responds, to describe itself as an ordinary ad tech business and reject the spy label.
- Ad exchanges will tighten vetting. At least some exchanges will review how a single buyer reached such a large share of Starlink-origin bids.
- SpaceX will face questions on privacy controls. Customers and carriers will ask what Starlink can offer to limit ad-based tracking at the terminal level.
- Other researchers will test other networks. TrendAI’s method can be repeated against other satellite and mobile-network traffic, and rivals in threat intelligence will try.
- Lawmakers will ask for briefings. Given the countries involved and the company’s reported nationality, political attention is likely, though formal action is less certain.
The Takeaway for Hardware Buyers
The takeaway: a connectivity product is also a privacy product. A dish that serves a whole household or village concentrates identity signals in one place, and anyone able to buy ads can aim at that place. The TrendAI findings, 105 countries ranked first, a roughly 13% share of winning bids and a multiple of about five over the average, show how far a single buyer can reach.
What remains unproven is the purpose. Reuters called it likely surveillance. The company has not been shown to have tracked a specific person, and no report we reviewed says it did. Until more evidence appears, the careful reading is that a highly unusual ad-buying pattern exists, a company has been tied to it by six sources, and the intent is still an open question.
Frequently Asked Questions
What did Reuters report about Starlink users on October 27, 2026?
Reuters reported that six people familiar with the matter said Israeli ad tech company Discover-Tech was among the largest sources of digital ads shown to Starlink users, and that the ads were likely used to geolocate or otherwise surveil them. The surveillance purpose is an allegation, not an established fact.
What is Shadow-Earth-79?
Shadow-Earth-79 is the codename TrendAI used in its October 15 report for an ad tech entity that bid heavily on Starlink traffic. The report did not publicly name Discover-Tech. Six sources told Reuters the two are the same.
Is Discover-Tech a spy company?
That has not been established. Available reporting identifies Discover-Tech as an Israeli ad tech company. Reuters’ headline used the phrase alleged spy company, but the surveillance claim remains unproven and unconfirmed by any court or regulator.
How many countries were involved?
Reuters reported activity in more than 100 countries. TrendAI’s research states that Shadow-Earth-79 was the number-one bidder in 105 countries for observed Starlink traffic.
Was my Starlink data stolen or my device hacked?
Nothing in the reporting says so. The activity described is ad bidding, not a breach of Starlink or of users’ devices. No victims, user counts or spyware deployments have been identified in the material reviewed.
Which countries did TrendAI single out?
The entity was the top ad buyer in Syria, Libya, Yemen and South Sudan and the No. 2 buyer in Afghanistan. It won an implausibly dominant share of bids in Hungary, Israel, Egypt, Azerbaijan and Venezuela.
How can Starlink users reduce ad-based tracking?
Use DNS-level blocking, reset the advertising ID on devices, choose a browser with tracker protection, limit location permissions, and consider a trusted VPN for sensitive browsing. These steps shrink the data that ad auctions can see.
Has SpaceX or Discover-Tech responded?
The excerpts of the Reuters report available at publication do not include a response from either party. We will update this analysis if a statement appears.
