Digital Ad Bidding Allegedly Being Weaponized to Track Starlink Users

Cybersecurity experts have uncovered a sophisticated digital surveillance operation in which advertising technology was allegedly weaponized to track, geolocate, and profile high-risk individuals across conflict zones, sanctioned nations, and sensitive international networks using SpaceX’s Starlink satellite internet service.

According to a comprehensive research report published by TrendAI Research, an unidentified threat cluster designated as SHADOW-EARTH-79 has been systematically abusing ad-tech infrastructure for intelligence gathering. Rather than operating a legitimate commercial advertising enterprise, the entity has leveraged automated millisecond auctions to harvest granular telemetry data, construct behavioral profiles, and monitor targets in politically volatile environments.

The investigation, released on October 15, 2026, reveals that SHADOW-EARTH-79 emerged as the single largest winning bidder for advertisement impressions across 49 countries. Many of these nations feature prominently on government travel advisory lists or experienced critical elections close to the observation window.

The entity captured implausibly dominant market shares in several territories, including Hungary, Israel, Egypt, Azerbaijan, and Venezuela, where its winning bid shares ranged between 72% and 91%.

The report highlights a pronounced over-representation of SHADOW-EARTH-79 within satellite internet traffic. Researchers analyzed global traffic originating from SpaceX Starlink address space and discovered that the entity captured approximately 13% of all winning bid events. This represents a concentration five times higher than the baseline average of three percent, making SHADOW-EARTH-79 the most aggressive high-volume buyer across Starlink infrastructure globally.

Starlink terminals provide vital connectivity in regions where traditional terrestrial networks are degraded, destroyed, or heavily restricted by authoritarian regimes. Consequently, the entity secured top bidder status in 105 countries regarding Starlink traffic, including active conflict zones and sanctioned jurisdictions such as Syria, Libya, South Sudan, Yemen, and Myanmar.

Industry experts note that legitimate Western commercial advertising demand in these regions is virtually nonexistent, pointing instead to a deliberate intent to reach specific mobile devices in sensitive geographic pockets.

The campaign exploits the architecture of real-time bidding, a computerized auction system that determines digital advertisements across websites and mobile applications within milliseconds. To facilitate targeted auctions, publishers transmit extensive device metadata to hundreds of competing bidders simultaneously. This telemetry data typically includes precise geographic coordinates, Internet Protocol addresses, network routing numbers, device models, operating systems, and historical location logs.

When operators secure ad impressions through the network, they can deliver manipulated image assets or embedded JavaScript payloads directly into user browsers and applications.

These scripts facilitate sophisticated user movement profiling, device fingerprinting, and data exfiltration.

TrendAI researchers reconstructed the back-end infrastructure of SHADOW-EARTH-79 using artificial intelligence-assisted analysis of open JavaScript asset bundles. The examination uncovered administrative features tailored for manual script injection, user de-anonymization, and advanced filtering of tracked individuals, confirming the platform functions as a dedicated intelligence-gathering tool.

The findings underscore a persistent vulnerability on the demand side of the digital advertising ecosystem. While the industry has spent decades combating financial ad fraud, malicious surveillance via ad bidding remains a potent vector for cyber operations.

To mitigate these risks, security researchers urge governments, enterprises, and high-risk personnel operating in sensitive environments to adopt rigorous defensive postures.

Recommendations include resetting mobile advertising identifiers, disabling personalized advertising features, restricting third-party application permissions, and activating device lockdown modes where available.

Organizations are advised to deploy advanced ad-blocking software capable of intercepting web traffic and stripping malicious ad tags before telemetry data leaves the device.