An Israeli ad technology company identified in a Trend Micro research report as operating an advertising-based tracking operation has been removed from Google's and Comcast's advertising platforms. The report, issued October 15 by TrendAI, Trend Micro's research arm, attributes the activity to Discover-Tech under the codename Shadow-Earth-79. Google and Comcast have since said they removed the firm from their advertising platforms.
According to TrendAI, the operation exploits the way online ads are sold, with advertisers bidding in real-time auctions for space on websites and in apps. Each bid request can carry details about the person on the other end, and when collected over time and combined with other data, that information could be used to identify people, follow their activity across the web, or select targets for spyware. TrendAI said its attribution process is designed to reduce the risk of misattribution and what it described as hype-driven labels that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions.
The geographic pattern is what drew scrutiny. Shadow-Earth-79 was reportedly the largest ad buyer in Syria, Libya, Yemen and South Sudan, and the second largest in Afghanistan, while also claiming unusually large shares of bids in Hungary, Israel, Egypt, Azerbaijan and Venezuela. TrendAI said the pattern points to targeting and tracking infrastructure rather than a commercial advertising operation. That assessment is plausible given how little legitimate Western advertising demand exists in sanctioned or war-torn markets.
The report also says a major U.S. technology company and an international organization have opened internal inquiries into whether the firm's ads targeted their employees.
Starlink is a focus of concern because the service works outside conventional telecom networks, making it a lifeline where governments restrict internet access and making its users an attractive target for those same governments. In April, Iran's nationwide internet blackout passed 1,000 hours, with authorities reportedly going after Starlink terminals and imposing severe penalties for possessing one. Earlier this month, SpaceX also limited Starlink service for Ukraine's high-speed military drones, which Ukrainian officials say complicates logistics and operations.
Advertising and consumer technology have been abused for tracking before. A backdoor was previously found in a popular iOS ad library that could collect device-location data and capture screenshots, while Chrysaor, Android spyware linked to the Pegasus family, was discovered by Lookout and Citizen Lab on a small number of devices. More recently, a researcher claimed to have found extensive data collection, including ad-related telemetry, inside a Samsung smart TV's Tizen operating system, though those findings are still being investigated.
More cybersecurity news from TechManNews.
