Voice of Urdu – International News in English & Urdu

Israeli Ad Firm Tied to Spyware Was Top Starlink Bidder — AI-generated representative image. A cybersecurity analyst reviews global ad-tracking network data on monitors in a research office.

Editorial Team

Trend Micro researchers say Discover-Tech concentrated ad spending on Starlink users and conflict zones, pointing to a tracking operation disguised as advertising.

An Israeli online advertising company implicated in spyware attacks was the leading bidder for advertising space targeting SpaceX's Starlink users in more than 100 countries, according to Japanese researchers, bolstering claims the firm was operating a "targeting and tracking" infrastructure disguised as a commercial advertising business.

The findings, published October 15 by TrendAI, a unit of cybersecurity firm Trend Micro, identified the advertiser only by the codename Shadow-Earth-79. Six people familiar with the research subsequently told Reuters the codename referred to Discover-Tech, an Israeli advertising technology company.

The research adds a new dimension to earlier investigations by Canadian watchdog Citizen Lab and New York-based ad security firm Confiant, which identified Discover-Tech as a middleman helping spyware companies track internet users and potentially infect their devices without their knowledge. The findings raise fresh questions about how commercial advertising infrastructure may be repurposed for surveillance.

Key Findings

TrendAI researchers examined advertising activity across 228 countries and territories and found Discover-Tech concentrated spending in markets with little appeal to conventional advertisers. Palestine was the most heavily targeted market despite its population having severely limited access to Western goods and relatively little purchasing power.

The company was also the largest advertising bidder in Syria, Libya, Yemen, and South Sudan, and the second-largest in Afghanistan. Noting that "the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero," the researchers concluded the company was running "targeting and tracking infrastructure rather than a commercial advertising operation."

The findings suggest Discover-Tech may have been attempting to identify, geolocate, or monitor Starlink users. However, they do not establish that the company successfully infected Starlink users' devices with spyware.

Background and Company Leadership

Discover-Tech was founded in 2020 by Israeli entrepreneur Dekel Boni and appointed Eric Banoun as its director. Banoun co-founded Circles, a surveillance company affiliated with Pegasus spyware developer NSO Group, and Senpai Technologies, which developed and sold surveillance software to governments including those of Angola, Indonesia, and Malaysia.

Banoun also founded Intelos, which uses advertisements similar to those placed by Discover-Tech to surveil and geolocate individuals. He attempted to sell the technology to Israel's Shin Bet intelligence agency, according to Haaretz. The newspaper also identified Sara Hamou, through her holding company, as a Discover-Tech shareholder. Hamou is a former manager at Intellexa, the company that marketed Predator spyware in Greece, and was sentenced to eight years in prison earlier this year for her role in the Predator scandal.

Al Jazeera Targeting and Government Links

Discover-Tech's advertising infrastructure was used to target at least 45 devices at Al Jazeera with Candiru spyware in 2024 and 2025, according to Citizen Lab. Researchers confirmed some devices were infected through malicious advertisements that required no interaction from users.

The attacks occurred during a period of heightened tensions between Israel and the Qatar-based broadcaster, which Israeli authorities have accused of threatening national security. Candiru was founded by two Israel Defense Forces (IDF) intelligence veterans and operates under Israeli defense export controls. While the Israeli government has not been accused of ordering the surveillance, the targeting raises questions about whether the company's clients shared interests with Israeli authorities. Investigators have not identified the government or client responsible for commissioning the attacks.

Company Status and Platform Response

Following the investigations by Citizen Lab and Confiant, several major advertising companies took action against Discover-Tech. Google, Comcast-owned Beeswax, and Eskimi blocked the firm from their platforms, while Vungle suspended its access pending a review. Industry association IAB Europe also suspended Discover-Tech from its list of approved vendors.

Discover-Tech's website, which markets the company as a "tailored digital advertising agency," remains active. The firm has not publicly responded to the findings reported by Citizen Lab, Confiant, or TrendAI.