The Number One Bidder Was Not Selling Anything

At a glance

What surfaced. Researchers at TrendAI, the research unit of Trend Micro, tracked an ad-tech entity they call SHADOW-EARTH-79 and concluded, with moderate-to-high confidence, that its advertising presence functions as targeting and tracking infrastructure rather than a commercial advertising operation. Six people familiar with the matter told Reuters the codename refers to the Israeli ad-tech company Discover-Tech. Citizen Lab and Confiant named Discover-Tech publicly on the same day the TrendAI paper appeared, October 15, 2026.

Who is exposed. Anyone whose device answers advertising auctions on a connection an observer wants to map: satellite internet users in this case, and users of sensitive networks generally. Citizen Lab and Confiant said the ads were shown inside dozens of sensitive networks belonging to media organizations, governments, and tech firms.

What it is not. It is not a break of the satellite link, and it is not a break of encryption. Nothing in either report says message content was read. The leak happens before content exists, in the auction that decides which ad a device is shown.

The short verdict. A surface that runs an advertising auction broadcasts the facts an observer needs: where the device is, what network it sits on, what it is. A surface with no auction on it has nothing to broadcast. That difference is a design decision, and it is the one our own systems are built on.

What the researchers found

TrendAI analyzed advertising telemetry across a 228-day window and a single demand-side platform, and published the work on October 15, 2026, as “Invasive Ads: The Unconventional Cyber Surveillance Attack Surface.” The pattern that drew the researchers in was not subtle:

• On Starlink address space, SHADOW-EARTH-79 took 12.9 percent of the ads served, against a baseline share of 2.6 percent across all traffic, a lift of about 4.9 times its ordinary footprint.
• It was the winning bidder on Starlink traffic in 105 countries. Some of them, including Cameroon, Syria, Sudan, Myanmar, and Libya, are countries where Starlink is officially banned or restricted by regulation.
• Across all traffic, it was the number one winning bidder in 49 countries, taking between 72 and 91 percent of bid events in Hungary, Israel, Egypt, Azerbaijan, and Venezuela.
• It was the top ad buyer in Syria, Libya, South Sudan, and Yemen, and the second-ranked buyer in Afghanistan, markets where, in TrendAI’s words, the demand for legitimate Western advertising is effectively zero.
• The networks its ads landed on skewed, in some countries, toward address space belonging to government networks.
• When TrendAI reconstructed the entity’s back-end systems, the interface carried functions such as manual script injection and de-anonymization, features the researchers judged consistent with a tool built for surveillance and intelligence gathering rather than advertisement management.

Reuters reported on October 27 that Google, Comcast, and other companies have removed Discover-Tech from their ad platforms since the investigations appeared, and that at least one large U.S. tech company and one international organization have opened internal inquiries into whether the ads targeted their employees. SpaceX did not respond to requests for comment. Discover-Tech and its chief executive did not respond over two weeks.

How an auction learns where you are

Real-time bidding works like this. A page or an app has an empty slot. Before the slot is filled, an auction runs in milliseconds, and to run it, information about the device is provided to every bidder competing for the slot, including bidders the device’s owner will never interact with directly. TrendAI lists what travels: the device’s geolocation, its IP address, the network it belongs to, and device details such as type, model, and screen size. The winning bidder then delivers the creative, which can carry script that collects more.

One auction says little. Thousands of auctions, collected and collated over time and merged with other information, say a great deal: where a person is, when they move, which networks they work from, and which device is theirs. Reuters’ sources put the end of that chain plainly: users can be de-anonymized, followed around the web, and in some cases set up for targeting with surveillance software. The auction is the collection point. The profile is the product.

Notice what the technique never touches. It does not defeat the satellite link. It does not defeat encryption. It does not need to. The bid request is sent, by design, to strangers, and it is sent in the clear of the marketplace. Anyone defending a connection by hardening the pipe and staffing the cipher has guarded the two doors this technique does not use.

Our verdict

VERDICT. The exposure in this story is the advertising auction itself, and it is closed by design, not by vigilance. Our surfaces are built to carry no advertising and no advertising technology: there is no auction on our side of the glass, so there is no bidder telemetry to harvest. A member’s identity in our design is carried by keys the owner holds, never by an IP address or a device identifier, and the record of what happened is a sealed log the owner holds, not a file on our servers. The system is designed to hold as little about the people who use it as the work allows, so a harvested bidstream, brought to our door, finds no house dataset to be merged against. The satellite, the tower, and the fiber underneath are transport, and transport is untrusted: neither identity nor receipts ever rest on it.

MITIGATION. Build the sensitive surface with no auction on it. Where a tool must be ad-supported to exist, keep it off the devices and networks whose locations are worth money to an observer, and treat every ad call from a sensitive address as a position report sent to strangers, because that is what it is.

The Dome: the owner’s side of the phone

How it works. Think of the Dome as the part of the phone that is yours. Inside it, you are not a username in somebody else’s database. You hold your own keys, the way you hold the key to your own front door, and the system knows you by those keys, not by your phone’s address on a network or a number burned into the device. Almost nothing about you is collected to be held, because almost nothing needs to be. And the record of what happened, the receipts, is sealed and held by you, not filed away on a company server. In the house doctrine the three legs keep separate jobs, on purpose: the Dome holds, the Gates decide, and the Receipts prove.

What part it plays here. A bounded one, and we say so plainly. The harvest in the TrendAI story does not happen inside the Dome. It happens out on the open phone, in ad-supported apps and ordinary browsing, where auctions run all day. The Dome does not pretend to answer those auctions, and it does not pretend to stop them answering. What happens outside stays outside, and any design that claims to govern the whole handset is claiming more than a design can do.

What it mitigates. The step that turns a leak into a person. A harvested bidstream is a pile of sightings: an address, a device, a place, a time. It becomes a named and located human being only when it is merged against a dataset that ties that address or that device to an identity. Inside the Dome there is nothing to merge against: no house dataset profiling the members, and no identity resting on a network address. The sightings stay sightings, because the joining table was never built.

The honest limit

One caution survives all of this, and TrendAI states it about ad blockers: a blocker that hides the ad does not necessarily stop the tracking event, because the bid request went out before the ad came back. Tools that hide the merchandise do not close the marketplace. The bounded claim stands: on a surface built with no advertising in it, and inside the Dome, this technique gets nothing. Beside that surface, on the same handset, it can still get plenty.

What to do about it

For a person whose movements are worth money to someone:

1. Treat every ad-supported app and page as a beacon that reports position, network, and device to whoever bids. On the device you carry into sensitive places, prefer paid or ad-free versions, or leave the app behind.
2. Reset your advertising ID and turn off ad personalization. It does not end the auction, but it breaks the thread that ties one month of auctions to the next.
3. Strip permissions from apps that do not need them, location above all. An app that cannot read your location cannot include it in what it hands the marketplace.
4. If your work puts you in a conflict zone, a sanctioned state, or a role where movement patterns are sensitive, use the device’s high-protection mode where one exists (Apple’s Lockdown Mode is the named example in the TrendAI recommendations) and keep ad-supported browsing off the carried device entirely.
5. For an organization: filter or block ad traffic at sensitive locations, and block the back-end infrastructure of any ad operator identified as a surveillance risk. TrendAI’s recommendation to the industry is the same in kind: investigate advertisers whose bidding profiles look like this one, and judge their legitimacy before their impressions reach your people.

Sources and version

Built from the public record: TrendAI (Trend Micro), “Invasive Ads: The Unconventional Cyber Surveillance Attack Surface,” October 15, 2026; Reuters, “Alleged Israeli spy company heavily targeted Starlink users, sources say,” October 27, 2026; Citizen Lab and Confiant publications of October 15, 2026, as reported by Reuters. Figures are TrendAI’s, from its published telemetry tables. The identification of SHADOW-EARTH-79 as Discover-Tech rests on Reuters’ six sources and the Citizen Lab and Confiant naming; TrendAI itself did not name the company.

October 27, 2026: Initial version.