Hackers Abuse Online Ads to Track Starlink Users and Spy on Individuals Across 49 Countries

Advertising infrastructure is increasingly being repurposed as a surveillance channel that can profile internet users and track their movements across sensitive locations, according to research from TrendAI.

Investigators identified an operation, referred to as SHADOW-EARTH-79, that made unusual ad purchases and used a reconstructed software interface, suggesting its primary purpose is intelligence gathering rather than conventional marketing. Notably, it targeted Starlink users.

This group emerged as the largest winning bidder in 49 countries, based on researchers’ observed advertising traffic. Additionally, it dominated Starlink advertising traffic in 105 countries.

Online Ads to Track Starlink Users

These findings describe different traffic categories and do not represent confirmed victim counts. Researchers assessed the operation as targeting and tracking infrastructure with moderate to high confidence.

The activity exploits real-time bidding (RTB), which auctions ad impressions in milliseconds. Bid requests can reveal information such as IP addresses, geolocation, autonomous system numbers, and device characteristics to competing advertisers.

Selected Data From the Supplied Research

Metric	Observed result
Countries where the group led overall winning bids	49
Countries where it led Starlink winning bids	105
Starlink impressions purchased in the comparison period	66,208
Share of observed Starlink impressions	12.9%
Overall baseline share	2.6%
Relative Starlink concentration	4.9×
Total captured requests analyzed	84,710,348

Combined with advertising identifiers, click records, and location histories, this information can create detailed behavioral profiles without users directly interacting with the bidders.

Winning bidders deliver advertising content that may include JavaScript capable of further data collection. Potential uses include movement profiling, device fingerprinting, and interest analysis based on the website or application displaying the ad. However, the findings do not confirm that every purchased impression delivered malicious code or compromised a device.

SHADOW-EARTH-79 purchased 66,208 Starlink impressions over 90 days, representing 12.9% of the observed Starlink advertising impressions, compared to a 2.6% overall baseline share.

This results in a 4.9-fold increase in interest in that network, not a fivefold increase in confirmed surveillance victims. The operation ranked as the second-largest Starlink buyer by raw volume.

This distinction matters because Starlink connectivity is especially beneficial in areas where terrestrial networks are unreliable, such as conflict zones. Overall, in general advertising traffic, this operation captured 91.1% of observed bids in Hungary, 90.1% in Israel, and 77.2% in Egypt. Researchers also noted purchases in conflict-affected markets where commercial motivations seemed questionable.

Investigators used AI-assisted analysis to reconstruct the application’s functionality from exposed JavaScript bundles and related infrastructure artifacts.

The recovered interface revealed features associated with manual script injection, de-anonymization, and advanced IP address filtering. Combined with the bidding patterns, these capabilities support the researchers’ conclusion that the platform serves surveillance and intelligence purposes.

The investigation analyzed 84,710,348 captured requests over an aggregate collection window from December 31, 2025, to August 15, 2026.

This telemetry included 154 buyer seats and covered 232 country classifications. However, the visibility was limited to one demand-side platform, which restricts conclusions about the broader ecosystem. Additionally, IP geolocation uncertainty affected some Starlink country assignments.

TrendAI recommends restricting advertising traffic on sensitive devices and networks, limiting ad-supported applications, disabling advertising personalization, and reviewing app permissions. Resetting advertising identifiers can help reduce continuity in some tracking. However, these measures reduce exposure but do not guarantee protection against surveillance or identification.

Researchers also caution that merely hiding advertisements may leave tracking requests intact. Effective defensive controls should prevent connections to advertising backends or remove advertising tags before sensitive information leaves devices.

For high-risk personnel, organizations should combine network filtering, restrictive permissions, and available device protection modes, while investigating suspicious bidders and blocking identified surveillance infrastructure where operationally feasible.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.