Starlink Users Targeted in Massive Surveillance Campaign

How the Tracking Mechanism Works

Starlink users worldwide are facing a significant security threat. According to data from the cybersecurity research group TrendAI, an Israeli company called Discover-Tech is tracking individuals connected to the satellite internet network using specially crafted malicious advertisements. Most alarmingly, users do not even need to click on an ad for the tracking to begin; data collection starts automatically the moment an ad appears on a user's device or webpage.

This method allows cybercriminals to monitor user activity across both browsers and various applications. This creates a de-anonymized profile of the user, which serves as a basis for more detailed surveillance. The campaign spans over 100 countries, including regions where internet access is restricted.

Targeted Activity in Conflict Zones

The study's authors found that Discover-Tech was particularly active in countries such as Syria, Libya, Yemen, and South Sudan. Interestingly, there is virtually no demand for legitimate Western advertising in these territories, yet the company was a dominant participant in ad placement auctions. This indicates that the placements were not for commercial purposes but were intended solely to identify specific users.

Starlink is frequently used in areas where governments block internet access or where infrastructure has been destroyed by conflict. While satellite connectivity is critical in these regions, the system does not protect users from threats spread via advertisements. Most websites visited by users load ads through third-party platforms, providing hackers with an opening to exploit this space.

Measures Taken

Following the disclosure of these activities, Google, Comcast, and other major technology corporations have blocked Discover-Tech from their advertising platforms. Notably, this is not the first time the company has been linked to such activities; reports previously surfaced that they had attempted to track journalists using similar malicious ads.

For Starlink users, this incident underscores the importance of maintaining cybersecurity hygiene. While this tracking method is technically difficult to detect, such incidents serve as a reminder that any online advertisement, no matter how harmless it may appear, could pose a potential threat. It is expected that the company owning Starlink and other security services will develop additional mechanisms to protect against these types of attacks in the near future.