Israeli Ad Tech Firm Accused of Tracking Starlink Users

Israeli advertising technology firm Discover-Tech allegedly leveraged digital advertising networks to surveil and profile Starlink satellite internet users across more than 100 countries, including Malaysia. A report published on 15 October 2026 by cybersecurity researchers at TrendAI identified the entity under the codename SHADOW-EARTH-79, revealing it dominated ad auctions targeting Starlink internet traffic. While the activity does not prove direct device compromise, it exploits real-time ad bidding to harvest location and behavioural data from users. For Malaysian satellite broadband subscribers, the findings highlight significant digital privacy vulnerabilities across SpaceX's network, prompting domestic scrutiny under national cybersecurity assessment frameworks overseen by the National Cyber Security Agency.

Key Facts

Cybersecurity research reveals extensive commercial surveillance operations exploiting digital advertising infrastructure to track satellite broadband connections worldwide. Verified technical data confirms Discover-Tech captured disproportionate auction volumes targeting Starlink network traffic across 105 nations. Discover-Tech secured approximately 13% of all winning advertisement bids across analysed Starlink traffic, outperforming competitor averages fivefold.

How Were Starlink Users Allegedly Tracked Through Digital Ads?

Surveillance occurred through real-time bidding auctions that broadcast subscriber network data to commercial advertisers competing for banner space. During these automated digital transactions, advertising systems broadcast user IP addresses, approximate geographic coordinates, device specifications, and unique device identifiers to competing bidders before any advertisement renders.

By capturing real-time bidding auction broadcasts, an advertising technology firm can compile detailed profiles without requiring direct user interaction. When combined with browsing activity, historical locations, and persistent device identifiers, this data allows observers to identify specific individuals, track movement patterns, and monitor personnel operating in sensitive locations. TrendAI documented that Discover-Tech operated as the single largest buyer of ad impressions across 49 countries within the broader advertising traffic examined.

Real-time bidding systems transmit IP addresses, device types, and approximate locations to advertisers before an advertisement is served.

Which Organisations and Countries Were Flagged in the Investigation?

Bidding activity spanned over 100 international jurisdictions, with disproportionate volumes recorded in Malaysia, Thailand, Saudi Arabia, and the United Arab Emirates. The advertising buyer dominated Starlink-associated traffic across 105 countries, operating even within territories where SpaceX satellite broadband services are officially banned, restricted, or unlicenced by domestic authorities.

Discover-Tech had previously been named in separate cybersecurity investigations conducted by Citizen Lab and advertising verification company Confiant. Those inquiries revealed that the firm abused digital ad bidding mechanisms to collect telemetry linked to sensitive networks belonging to government bodies, media organisations, and technology corporations. Following these findings, Google and Comcast severed ties with Discover-Tech by removing it from their advertising exchanges. Reuters reported that at least one major US technology company and an international organisation launched internal investigations regarding potential workforce tracking. Neither Discover-Tech nor SpaceX responded to requests for comment.

Discover-Tech emerged as the primary ad bidder targeting Starlink connections across 105 countries, including restricted territories.

How Can Satellite Internet Users Mitigate Ad-Based Surveillance?

Subscribers can reduce surveillance exposure by restricting device telemetry, disabling advertising personalisation, and preventing background data exchange with ad networks. While conventional browser extensions hide visible advertisements, comprehensive mitigation requires intercepting network tracking requests before web applications communicate with remote advertising server backends.

TrendAI recommends that individuals operating in sensitive environments reset their mobile advertising identifiers regularly and rigorously audit application permissions, especially location tracking rights. Users should also minimise the execution of ad-supported applications on devices reserved for critical or confidential workflows. Basic ad blockers merely conceal visual promotional elements on a page; they do not reliably halt the underlying real-time auction broadcasts that share user metadata with third-party bidders.

Standard ad blockers merely conceal promotional banners and do not halt backend real-time bidding data transmission.

What It Means for Malaysian Buyers

Malaysian Starlink subscribers face potential metadata profiling via advertising networks, but the satellite service itself remains under United States jurisdiction. Although the National Security Council and National Cyber Security Agency continually assess foreign software risks, SpaceX operations differ legally from Israeli-registered platforms like Waze that are subject to Tel Aviv court governance.

The Malaysian government previously restricted the use of navigation platform Waze for official duties because its data controller is incorporated in Israel, whereas Google Maps was exempted due to its American corporate domicile. Starlink operates similarly as a US-regulated infrastructure provider. Nevertheless, the National Security Council (MKN) has affirmed that the National Cyber Security Agency (NACSA) continues to evaluate foreign-linked digital applications and will take protective measures if operational risks emerge. Starlink hardware and subscriptions remain fully accessible to Malaysian commercial and consumer users, though enterprise users must deploy network-level tracker blocking to prevent passive profiling.

Starlink operates under United States legal jurisdiction, distinguishing it from Israeli-incorporated services previously restricted by Malaysian government directives.

Common Questions

Digital advertising surveillance presents distinct technical and regulatory considerations for satellite internet subscribers operating in Southeast Asia. Verified investigative findings explain the technical mechanics of real-time bidding exposure and clarify domestic regulatory oversight. Network telemetry confirms digital ad profiling targets web browsing traffic rather than core satellite transmission hardware.

Were Malaysian Starlink users directly hacked?

No evidence indicates that Malaysian user devices were directly compromised or hacked. The documented activity involved real-time advertising bidding auctions where metadata such as IP addresses and device types was collected to profile browsing behaviour and approximate geographic locations.

Will the Malaysian government ban Starlink over these allegations?

A ban has not been announced. Starlink is a United States-based service subject to American jurisdiction, unlike Israeli-incorporated apps previously restricted for official duties, though the National Cyber Security Agency continues evaluating digital platforms for operational security risks.

Does using a standard ad blocker protect against this tracking?

Standard ad blockers that only hide banner displays do not prevent tracking. Users require specialised tools that block network tracking requests and cut off communication between applications and advertising backends, alongside resetting their device advertising identifiers.

Sources and Methodology

This dispatch synthesises verified technical reporting from Lowyat.NET, Reuters, and research documentation released by TrendAI, Citizen Lab, and Confiant on 15 and 28 October 2026. Data verification was conducted directly against published telemetry metrics without financial conversions, as the underlying disclosures contain no hardware pricing or subscription fees.

• Primary reporting: Lowyat.NET investigation by Heirul Kamel, published 28 October 2026.
• Secondary sources: Investigative disclosures from Reuters, TrendAI (research dated 15 October 2026), Citizen Lab, and Confiant.
• Data verification date: 28 October 2026.
• Currency conversions: None applied; source materials contain solely technical and cybersecurity network telemetry.

All investigative data derives from cybersecurity research published by TrendAI, Citizen Lab, and Confiant in October 2026.