An Israeli advertising technology company has been linked to a surveillance operation targeting internet users in more than 100 countries, including people accessing the internet through Elon Musk's Starlink satellite network. Investigations by cybersecurity researchers suggest that commercial advertising infrastructure was being exploited to identify potential surveillance targets, exposing how the global digital advertising system can be repurposed for intelligence gathering.
INR Report: Based on reporting by RT Newsroom for RT HERE, published 28 October 2026, drawing on investigations attributed to Reuters, Citizen Lab, Confiant and TrendAI.
When Online Advertising Becomes a Surveillance Network
A cybersecurity investigation has raised concerns that an Israeli advertising technology company, Discover-Tech, used the global online advertising marketplace to identify and track internet users, including people relying on SpaceX's Starlink satellite communications network.
According to reporting by Reuters cited by RT, researchers from TrendAI, a division of Japanese cybersecurity company Trend Micro, identified an unusual advertising operation concentrated in countries affected by war, sanctions and political instability. Rather than focusing on conventional consumer markets, the operation reportedly placed substantial advertising bids in territories where commercial demand for Western products would ordinarily be limited.
The company was identified in the researchers' findings under the codename Shadow-Earth-79. TrendAI published its investigation on 15 October 2026, and Reuters subsequently reported that six individuals familiar with the research identified the operation as Discover-Tech.
The findings suggest that the advertising network may have been designed to gather information about internet users rather than sell goods or services. However, the evidence described in the report does not establish that Starlink users' devices were successfully infected with spyware.
That distinction is essential. The ability to identify or locate a potential target is not the same as demonstrating that a device has been compromised.
Why Starlink Users Attracted Attention
Starlink provides satellite-based internet access in locations where conventional telecommunications infrastructure may be damaged, unavailable or politically restricted. This makes the service particularly relevant in conflict zones and remote regions, including areas where journalists, humanitarian organisations and other users require communications independent of local terrestrial networks.
According to TrendAI's findings, Discover-Tech was the leading bidder for advertising space targeting Starlink users in more than 100 countries. The company also reportedly held the largest advertising-bid position in Syria, Libya, Yemen and South Sudan, and the second-largest position in Afghanistan.
The geographical concentration is significant because advertising expenditure is normally justified by the prospect of reaching consumers who might purchase advertised products or services. Heavy bidding in regions with limited commercial opportunities may therefore indicate that the advertiser has objectives unrelated to conventional marketing.
Researchers interpreted the activity as potentially consistent with identifying, locating and monitoring individuals. That interpretation is supported by the reported advertising patterns, but the identities of individual targets and the ultimate purchasers of any resulting surveillance data have not been fully established.
The Technology Behind Advertising-Based Surveillance
Online advertising relies on complex automated exchanges through which advertisers compete to display advertisements to individual users. These systems can process information about a device, its network connection, approximate location and browsing environment.
Such information is valuable for legitimate advertising, but it can also be exploited for surveillance. An operator with sufficient access to advertising exchanges may be able to collect technical identifiers and other signals that help distinguish one device or user from another.
Earlier investigations by Citizen Lab and New York-based advertising security company Confiant reportedly linked Discover-Tech to companies associated with surveillance technologies, including Candiru, Intelos and an operator identified as Dark Cartographer.
The researchers described a system in which advertising placements could be used to gather information about potential targets, with some advertisements potentially providing a route for delivering malicious code.
The central concern is that ordinary internet users may encounter such advertising without recognising that the advertisement itself could form part of a surveillance operation. In certain circumstances, malicious advertising can exploit vulnerabilities without requiring the user to click on the advertisement.
Nevertheless, different capabilities must be considered separately: collecting advertising data, tracking a device, identifying an individual and successfully installing spyware are distinct technical outcomes requiring different levels of evidence.
Palestine and Other Conflict Zones Featured Prominently
One of the most striking findings concerns the geographical distribution of Discover-Tech's reported advertising activity.
Among 228 countries and territories examined, Palestine was identified as the most heavily targeted location. Researchers reportedly found that Discover-Tech concentrated substantial advertising expenditure in areas where ordinary commercial advertising opportunities were comparatively limited.
The findings raise questions about the purpose of these campaigns and the identities of those who may have commissioned the resulting intelligence services.
However, an unusual concentration of advertising bids does not by itself establish who ordered the activity or whether it was directed by a government. The research points to patterns consistent with surveillance-related targeting, while leaving important questions about operational control unresolved.
The distinction between the nationality of a technology company and responsibility for a particular surveillance operation is especially important when evaluating allegations involving state intelligence agencies.
Who Controls Discover-Tech?
Dekel Boni (left) and Eric Banoun (right). Image published by RT; original photographer or agency not specified.
According to the source report, Discover-Tech was founded in 2020 by Israeli entrepreneur Dekel Boni, with Eric Banoun subsequently appointed as a director.
Banoun has been associated with several businesses operating in the surveillance technology industry. He co-founded Circles, a company associated with NSO Group, the developer of Pegasus spyware, and Senpai Technologies, which reportedly supplied surveillance software to government customers.
Banoun also founded Intelos, a company described as using online advertising systems to locate and monitor individuals. RT cites Haaretz reporting that Banoun attempted to sell related technology to Israel's Shin Bet domestic security agency.
The source also identifies Sara Hamou, through a holding company, as a shareholder in Discover-Tech. Hamou previously worked at Intellexa, the company associated with the Predator spyware platform, and was reportedly sentenced in Greece over her involvement in the Predator surveillance scandal.
These business connections are relevant because they place Discover-Tech within a wider commercial environment involving surveillance software, intelligence-related technologies and government customers.
They do not, on their own, establish that every associated company participated in the same operation or that any particular government directed Discover-Tech's reported activities.
The Al Jazeera Connection
The most consequential allegations described in the report concern surveillance targeting journalists at the Qatar-based broadcaster Al Jazeera.
According to Citizen Lab findings cited by RT, Discover-Tech's advertising infrastructure was used in operations targeting at least 45 devices associated with Al Jazeera during 2024 and 2025.
Researchers reportedly confirmed that some devices were successfully infected with Candiru spyware through malicious advertisements that required no interaction from the user.
This is materially different from the findings concerning Starlink. In the Al Jazeera cases, the source reports confirmed spyware infections, whereas the Starlink research identifies suspicious targeting and tracking activity without establishing successful device compromise.
The attacks occurred during heightened tensions between Israel and Al Jazeera. Israeli authorities have accused the broadcaster of threatening national security, while the targeting of journalists raises serious questions about press freedom and the protection of confidential sources.
The identity of the client responsible for commissioning the attacks has not been established in the supplied reporting. Nor does the evidence presented demonstrate that the Israeli government ordered the surveillance.
What the allegations do illustrate is the potential vulnerability of journalists and media organisations to surveillance systems delivered through advertising networks that are otherwise part of everyday internet activity.
The Relationship Between Spyware Companies and Governments
The wider surveillance industry operates at the intersection of commercial technology, national security and international diplomacy.
Israel maintains export controls over certain domestically developed surveillance technologies. Previous reporting cited by RT has examined how decisions involving spyware exports may intersect with diplomatic relationships and foreign-policy interests.
A 2021 Haaretz investigation, referenced in the source article, alleged that export approvals involving Pegasus technology were sometimes influenced by considerations relating to Israeli foreign-policy objectives.
Such allegations warrant scrutiny because commercial surveillance tools can be sold to governments and other customers whose activities may not be transparent to the public.
However, export licensing, commercial ownership and operational responsibility are separate questions. The existence of government export controls does not prove government involvement in every use of a licensed product.
For Discover-Tech, the unanswered questions remain who purchased its services, what information was collected, which individuals were targeted and whether any government agencies authorised or directed particular operations.
Advertising Platforms Respond
Following investigations by Citizen Lab and Confiant, several advertising companies reportedly restricted Discover-Tech's access to their systems.
Google, Comcast-owned Beeswax and Eskimi blocked the company from their platforms, while Vungle suspended access pending further review. Industry organisation IAB Europe also reportedly suspended Discover-Tech from its approved vendor listings.
These responses indicate that the allegations were sufficiently serious to prompt action by commercial advertising intermediaries. They do not constitute judicial findings concerning every allegation made against the company.
At the time of RT's report, Discover-Tech's website remained active, and the company had not publicly responded to the findings attributed to Citizen Lab, Confiant or TrendAI.
Does This Affect New Zealand?
The investigation has direct relevance to New Zealand's digital security, privacy protections and dependence on international technology platforms.
New Zealand businesses, government agencies, journalists and private citizens routinely interact with advertising networks operated beyond the country's jurisdiction. Those networks collect and exchange technical information as part of delivering online advertisements, creating potential opportunities for misuse where safeguards are inadequate.
Starlink is also used in New Zealand, including in rural and remote areas where terrestrial broadband options may be limited. The findings do not establish that New Zealand Starlink customers were specifically compromised, but they demonstrate why the security of satellite internet connections cannot be considered independently of the devices, applications and advertising services accessed through them.
For journalists, the implications are particularly important. Surveillance capable of identifying communications devices or compromising them through malicious advertising could threaten confidential sources, investigative reporting and the independence of the press.
New Zealand's Privacy Act 2020, cybersecurity arrangements and intelligence oversight mechanisms provide a framework for considering some of these risks. Nevertheless, international advertising exchanges and foreign surveillance companies present jurisdictional and enforcement challenges that cannot necessarily be resolved through domestic legislation alone.
Will this make New Zealand stronger? The question is whether New Zealand can strengthen its digital sovereignty by understanding how personal information travels through global advertising infrastructure, protecting sensitive communications and ensuring that public institutions retain sufficient technical independence to identify and respond to foreign surveillance threats.
The Evidence Points to a Wider Problem
The Discover-Tech investigation highlights a fundamental weakness in the modern digital economy: systems developed to identify consumers and deliver targeted advertising can potentially be repurposed to identify and monitor individuals.
The reported activity involving Starlink users raises questions about surveillance-related targeting across conflict zones. The separate findings concerning Al Jazeera demonstrate that malicious advertising has reportedly been used to compromise journalists' devices.
These findings should not be conflated. One concerns suspicious advertising behaviour and possible tracking; the other concerns reported spyware infections supported by forensic investigation.
The larger issue extends beyond any one company or country. As advertising technology becomes increasingly sophisticated, the same infrastructure that enables commercial targeting may provide opportunities for covert intelligence collection.
Determining responsibility requires further evidence concerning the operators, their customers, the technical methods used and the individuals affected.
Until those questions are answered, the investigation stands as a warning about the surveillance potential embedded within systems that millions of internet users encounter every day.
Sources