Starlink users targeted by Israeli ad firm in suspected surveillance campaign

By Raphael Satter WASHINGTON, Oct 27 (Reuters) - Experts at a digital defense firm recently found that an Israeli ad tech company was heavily targeting users ofStarlink's satellite internet service in a likely effort to spy on them, according to six people familiar with the matter.

REALNEWS HUB Newsroom

Oct 27, 2026, 21:41 UTC

A generic satellite dish terminal mounted on an urban rooftop at dusk with network data visuals on an adjacent monitor. — REAL NEWS HUB

An Israeli digital advertising company has extensively targeted users of the Starlink satellite network in an apparent effort to pinpoint their locations and monitor their online activity, according to cybersecurity specialists and people familiar with the situation.

Analysts at TrendAI, a research arm of Tokyo-based cybersecurity provider Trend Micro, determined that Discover-Tech was among the primary sources of commercial web ads directed at people connecting via SpaceX's satellite service. The researchers concluded the activity was likely aimed at tracking the whereabouts of users.

According to internal telemetry examined by the researchers, Discover-Tech emerged as the leading bidder for digital ad placements on Starlink traffic across more than 100 nations. Those included several jurisdictions where the satellite service is formally prohibited or heavily curbed. Digital ad bidding involves automated real-time auctions that allow advertisers to display marketing materials inside mobile apps and web browsers.

TrendAI issued a study on the activity on October 15, identifying the entity behind the campaign under the pseudonym Shadow-Earth-79 rather than naming Discover-Tech directly. Six people familiar with the investigation confirmed that the moniker referred to the Israeli firm. TrendAI said in a statement that its naming practices aim to minimize errors, prevent inflated labels, and avoid naming decisions that could confuse system defenders.

However, five people familiar with internal deliberations noted that TrendAI researchers originally considered identifying Discover-Tech outright before company executives decided against it due to legal worries.

Discover-Tech and its chief executive did not respond to requests for comment, nor did SpaceX.

Tracking Starlink hardware has drawn mounting interest from security services and governments worldwide. Because the terminals connect through SpaceX orbiters rather than domestic telecom infrastructure, users can bypass government internet blocks and operate in war zones. The satellite technology has become vital in Ukraine, where forces depend on it for communication on the front lines and for steering drone operations.

On the same date TrendAI published its findings, Canadian watchdog Citizen Lab and New York tech firm Confiant publicly named Discover-Tech in a separate investigation. Both organizations stated that the enterprise exploited auction mechanisms to harvest data generated during the bidding process. Over time, that information can be combined with other digital breadcrumbs to identify individual users and potentially expose them to surveillance tools.

Citizen Lab and Confiant found that promotional banners connected to the firm had appeared inside sensitive corporate, media, and governmental networks. Major tech firms including Google and Comcast have since booted Discover-Tech from their advertising systems.

TrendAI's report highlighted unusual bidding behavior, suggesting the setup functioned as surveillance infrastructure rather than a standard commercial business. The entity ranked as the top online ad buyer in conflict zones such as Yemen, Syria, Libya, and South Sudan, and was second in Afghanistan, despite minimal market demand for legitimate commercial promotions in those regions.

Earlier on this story

Oct 26, 2026Anthropic says Claude AI skirted paywall to reach Georgia vote figures
Oct 23, 2026UK urges households to store three days of emergency provisions
Oct 21, 2026PHP security flaw discovered with AI triggers global website shutdowns
Oct 21, 2026Meta ordered by New Mexico court to pay 25 billion dollars over data deception
Oct 20, 2026DeepSeek AI software banned across US federal civilian agency networks

Full coverage: Cybersecurity & Data Breaches

Explained: catch up on this storyWhat are the latest global cybersecurity and surveillance threats?Global authorities and security researchers have exposed a series of major digital threats, including covert advertising surveillance networks, autonomous AI intrusions, ransomware linked to patient fatalities, and internal espionage at top tech firms.Read the explainer →

Spotted an error? Report it · Editorial standards · Corrections policy

Source & verification

Verified

Reported from Al-Monitor.

Get breaking news alerts and the Morning Briefing

Verified stories in your inbox, every one linked to its sources. All newsletters →

Technology· 6d agoVerified

PHP security flaw discovered with AI triggers global website shutdowns

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems. Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had quietly been lurking in their software for years until they were uncovered using AI, saying that all users were “encouraged to update immediately.” With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution. Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of fixes. AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP: Black. He said the next step was the “mass compromise of every vulnerable web server on the internet”. PHP, a language that dates back to the early 1990s and initially stood for “Personal Home Page”, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning that any critical vulnerability potentially has enormous knock-on consequences. “All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the Internet.” Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched. Even some world leaders, who don’t typically get involved with software updates, weighed in. Japanese Prime Minister Sanae Takaichi, in a post on X, said website owners should “check whether your live site uses PHP and prepare to apply the new fix.” Bug found with AI The flaw in PHP was discovered using artificial intelligence, Alphabet-owned cybersecurity company Wiz said in a blog post. The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to have taken advantage of, the post said. “Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI, this is no longer a barrier.” Wiz said its research relied on Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said it coordinated with the PHP team, OpenAI, and the cybersecurity company Calif on the discovery of the vulnerability and patch verification. The company said it also partnered with Google Cloud, Cloudflare, Amazon’s AWS, Microsoft, WordPress.com operator Automattic, and other companies such as Fastly, Akamai, Imperva, and Vercel to protect customers and prepare mitigations. In a statement, the White House said it was made aware of the flaw on Friday. “This discovery demonstrates exactly why American leadership in SI is so critical,” the White House said, referring to President Donald Trump’s preferred term for artificial intelligence. “This is American innovation strengthening our national security. Critical software When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers. Because of its ubiquity, PHP runs roughly 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs, and because the vulnerabilities are considered so dangerous, experts are anxious about a potentially vast pool of sitting ducks. AI-assisted hacking campaigns, which have proliferated in recent weeks, would only make things worse, said Lukasz Olejnik, a visiting senior research fellow at King’s College London. “The scale is huge, and with AI, exploitation may happen instantly, on a large scale,” Olejnik said. The risk is particularly acute for small websites run by individuals or organisations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers. Security experts said such sites could take longer to patch and remain exposed well after fixes become available. Mass outages In the Netherlands, several organisations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites for the country’s five largest political parties and several hospital websites. Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform. Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure”. France’s Interior Ministry said it had placed all of its websites into preventive maintenance. Japanese cloud service provider Sakura Internet said on Wednesday it had suspended a database appliance function. A screen displays the unavailable French government website, info.gouv.fr, as cyber agencies warn that websites may be taken offline while PHP prepares a critical fix, in Berlin, Germany on October 21, 2026. — Reuters

Technology· 6d agoVerified

Meta ordered by New Mexico court to pay 25 billion dollars over data deception

Meta Platforms was ordered to pay a groundbreaking US$25 billion civil penalty to the state of New Mexico in a consumer deception case spurred by the Cambridge Analytica scandal. The fine issued by state court Judge Francis Mathew is among the largest verdicts issued in US legal history. The award comes after a jury in Santa Fe determined that Meta had violated the state’s consumer protection over 43 million times based on widely viewed deceptive statements made by the company and its top...

Technology· Oct 16, 2026Verified

Discover-Tech used web ads for vast surveillance operation, researchers say

Earlier in Technology

Technology· Oct 16, 2026Developing