’Israeli’ Spy-Tech Firm Exploited Online Ads to Target Starlink Users Worldwide
By Staff, Agencies
Japanese researchers have uncovered extensive activity by Discover-Tech, an "Israeli" advertising technology company suspected of helping spyware operators track internet users, including Starlink customers.
The findings strengthen concerns that the company may have used commercial advertising as a cover for a surveillance and targeting operation.
Earlier investigations by Canada-based Citizen Lab and US advertising security firm Confiant identified Discover-Tech as an intermediary allegedly assisting spyware operators, including Candiru and Intelos, as well as a little-known US-linked entity known as Dark Cartographer.
According to the investigations, Discover-Tech purchased advertising space across hundreds of thousands of websites and applications, collecting information about users who viewed the ads and making the data available to spyware companies.
The information could then be used to identify potential targets and attempt to infect their devices through malicious advertising code.
Research published on October 15 by TrendAI, a unit of Japanese cybersecurity company Trend Micro, found that Discover-Tech was the leading bidder for advertising space targeting Starlink users in more than 100 countries.
The company also ranked first in Syria, Libya, Yemen, and South Sudan, and second in Afghanistan. Palestine was the most heavily targeted of 228 countries and territories examined.
Researchers argued that the advertising patterns were inconsistent with ordinary commercial marketing, particularly in sanctioned countries and active conflict zones.
Six people familiar with the research subsequently told Reuters that the advertiser, initially identified by the codename Shadow-Earth-79, was Discover-Tech.
Founded in 2020 by "Israeli" entrepreneur Dekel Boni, Discover-Tech appointed Eric Banoun as its director. Banoun co-founded Circles, a surveillance company affiliated with Pegasus developer NSO Group, and founded Intelos, which uses advertising techniques to monitor and geolocate individuals.
According to "Haaretz", Banoun attempted to sell Intelos technology to "Israel's" Shin Bet intelligence agency.
"Haaretz" also identified Sara Hamou, a former manager at Intellexa, the company behind Predator spyware, as a Discover-Tech shareholder through her holding company.
The investigations have not established who commissioned the surveillance operations or whether Discover-Tech successfully infected Starlink users' devices.
The case has also raised concerns over the targeting of journalists. Citizen Lab reported that Discover-Tech's advertising infrastructure was used to target at least 45 devices at Al Jazeera with Candiru spyware in 2024 and 2025.
Researchers confirmed that some devices were infected through malicious advertisements requiring no user interaction.
Candiru was founded by veterans of "Israel's" military intelligence and operates under "Israeli" military export controls. Although no government or client has been identified as having commissioned the attacks, the findings have renewed questions about potential links between commercial spyware operations and "Israeli" security interests.
Following the investigations, Google, Comcast-owned Beeswax, and Eskimi took action against Discover-Tech, while advertising platform Vungle suspended the company's access pending a review.
IAB Europe also removed the firm from its list of approved vendors. However, Discover-Tech's website remains active, and the company has not publicly responded to the findings.
