Israeli Firm Discover-Tech Linked to Spyware Targeting Starlink Users
Recent investigations have revealed that Discover-Tech, an Israeli online advertising company, has been heavily involved in spyware attacks targeting users of SpaceX's Starlink service. This finding, reported by Japanese researchers, supports claims that Discover-Tech was operating a "targeting and tracking" initiative disguised as a commercial advertising business.
Earlier this month, Citizen Lab, a Canadian cybersecurity watchdog, along with New York-based ad security firm Confiant, published detailed reports identifying Discover-Tech as a facilitator for spyware firms, including Candiru and Intelos, as well as a lesser-known U.S.-linked operator known as Dark Cartographer. These firms allegedly used Discover-Tech's services to track internet users and potentially infect their devices without their consent.
Discover-Tech's operations involved purchasing advertising space across a vast number of websites and applications. By utilizing these ads, the company collected data on users who interacted with them, which was then made available to spyware companies. This enabled those companies to pinpoint specific targets and potentially deploy spyware through malicious advertising code.
Despite presenting itself as a legitimate commercial entity, Discover-Tech focused much of its advertising efforts on regions that would likely not attract conventional advertisers. Among 228 countries analyzed, Palestine emerged as the most targeted area, despite its limited access to Western goods and low purchasing power.
In over 100 countries, Discover-Tech was identified as the leading bidder for advertising space aimed at Starlink users. The company also ranked as the top bidder in conflict zones such as Syria, Libya, Yemen, and South Sudan, and was the second-largest bidder in Afghanistan, according to findings from TrendAI, a division of the cybersecurity firm Trend Micro. These findings were published on October 15, with the suspicious advertiser referred to by the codename Shadow-Earth-79, which was later confirmed to be Discover-Tech by sources familiar with the research.
The researchers noted that the demand for legitimate Western advertising in sanctioned or conflict-affected regions is virtually nonexistent. They concluded that Discover-Tech was likely operating a targeting and tracking infrastructure rather than a genuine advertising business.
While the findings suggest that Discover-Tech may have aimed to identify and monitor Starlink users, they do not confirm that the company successfully infected any devices with spyware. Founded in 2020 by Israeli entrepreneur Dekel Boni, Discover-Tech appointed Eric Banoun as its director. Banoun has a background in surveillance technology, having co-founded Circles, a company associated with the Pegasus spyware developer NSO Group, and Senpai Technologies, which has sold surveillance software to various governments.
Connections to Surveillance Technology Ventures
Banoun also established Intelos, which employs similar advertising strategies to surveil and geolocate individuals. Reports indicate that he attempted to market this technology to Israel’s Shin Bet intelligence agency.
Additionally, Sara Hamou, identified as a shareholder in Discover-Tech through her holding company, has a history with Intellexa, the firm that marketed the Predator spyware in Greece. Earlier this year, she received an eight-year prison sentence for her involvement in the Predator scandal.
It remains unclear who engaged the services of Candiru, Intelos, and Dark Cartographer after they acquired user data through Discover-Tech. However, it has been reported that Israel treats domestically developed spyware as a controlled defense export, maintaining authority over its sale.
According to a 2021 investigation by Haaretz, export licenses for Pegasus were often granted when sales aligned with Israeli foreign policy interests, including trade agreements or diplomatic support at the UN.
Discover-Tech's advertising infrastructure has been linked to targeting at least 45 devices associated with Al Jazeera using Candiru spyware in 2024 and 2025. This occurred during a period of heightened tensions between Israel and the Qatar-based broadcaster, which has been accused by Israeli authorities of posing a national security threat. Although there is no evidence that the Israeli government ordered Candiru to surveil Al Jazeera journalists, the targeting raises questions about potential shared interests between the company’s clients and Israeli authorities.
Clearance Granted
Following the investigations by Citizen Lab and Confiant, several major advertising firms took action against Discover-Tech. Google, Beeswax (owned by Comcast), and Eskimi blocked the company from their platforms, while Vungle suspended its access pending a review. The industry association IAB Europe also removed Discover-Tech from its list of approved vendors.
Despite these actions, Discover-Tech continues to operate under the guise of a "tailored digital advertising agency," and has not publicly addressed the findings reported by Citizen Lab, Confiant, or TrendAI.
