Programmatic advertising has a new threat model. Reuters reported on 27 October that the ad buyer behind a campaign targeting Starlink satellite-internet users is Discover-Tech, an Israeli company researchers had already accused of using ad placements to deliver spyware. Six people familiar with the matter identified the firm.
TrendAI, a Trend Micro research unit, did not name the buyer in its 15 October study. It tracked the operation as SHADOW-EARTH-79 and said the entity’s bidding was “consistent with a tool designed for surveillance and intelligence gathering.”
What the data shows
Over a 90-day test period, SHADOW-EARTH-79 served 66,208 ads to Starlink IP ranges in TrendAI’s telemetry. That was 12.9% of all Starlink ads, against a 2.6% share of all ads across every network, a lift of 4.9.
- Top Starlink bidder in 105 countries.
- 56.6% of Starlink bids in Australia; 91.3% in Argentina.
- Also ranked first in countries where Starlink is banned or restricted, though two locations rest on TrendAI’s own geolocation.
That pattern, TrendAI argues, is not normal ad buying. Normal bidders spread across networks; this buyer over-indexed on one satellite network used in conflict zones and restricted markets.
Why this matters for digital marketers
Every programmatic auction sends bid requests to every bidder before a winner is chosen. Those requests can carry IP address, network ASN, geolocation and device details. A buyer doesn’t need to win the impression, or get a click, to collect that data.
That flips the familiar supply-side story. The industry has pushed ads.txt to make sellers transparent, but the demand side lags: buyers.json and the DemandChain Object exist on paper, yet adoption is weak. A surveillance buyer can sit on the buy side and turn a marketing channel into tracking infrastructure.
Reuters says Google, Comcast and others have already removed Discover-Tech from their ad platforms. At least one large US tech company and one international organisation are checking whether their staff were targeted, the report says.
What to do about it
Treat bid-request data as sensitive telemetry. If your team runs programmatic, monitor buyer behaviour for the same lift TrendAI used: a bidder’s share of a narrow slice divided by its overall share. A buyer that suddenly dominates Starlink, government or conflict-zone traffic is a signal, not a targeting strategy.
- Audit DSP logs for bidder lift anomalies by ASN and country.
- Ask demand partners whether buyers.json is enforced.
- Treat IP and device fields in bid requests as personal data, not free targeting fuel.
The uncomfortable takeaway: the same machinery that makes ads relevant also makes users trackable. Security now has to be part of media buying, not just the IT team’s problem.
Source: PPC Land
