Ad-Injection Surveillance: Discover-Tech Infrastructure Linked to Zero-Click Mercenary Spyware Campaigns

Executive Summary

Encrygma analysts have confirmed a paradigm shift in the delivery of mercenary spyware, where threat actors are weaponizing legitimate advertising technology to deploy zero-click exploits. By leveraging the Discover-Tech platform, operators can now precisely target individuals based on mobile identifiers and location data, effectively turning the global ad-bidding ecosystem into a surveillance delivery pipeline.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, the use of advertising networks for exploit delivery represents a critical evolution in surveillance capabilities. Encrygma assigns this activity an ETSI score of 9.2, reflecting the high level of sophistication and the difficulty of detection. Unlike traditional phishing, this method requires zero user interaction, making it a preferred vector for high-value espionage.

Technical Details

Encrygma threat data shows that the Discover-Tech platform facilitates the purchase of ad space on over 70,000 mobile applications and 120,000 websites. The process involves injecting malicious payloads into the ad-bidding stream. When a target device loads an ad, the platform triggers a zero-click exploit chain that compromises the device's operating system. Encrygma analysts have identified that this process utilizes advanced fingerprinting techniques to ensure the payload is delivered only to the intended target, minimizing the risk of discovery by security researchers.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the attribution of the primary 'Dark Cartographer' campaign as 'High Confidence' regarding the infrastructure provider, Discover-Tech. However, the specific end-users of this infrastructure remain 'Moderate' confidence, as the platform serves as a broker for multiple mercenary spyware vendors, including entities previously associated with Candiru and Intellexa-linked operations.

Implications

The weaponization of ad-tech creates a systemic vulnerability that affects all mobile users. Encrygma warns that the ability to deanonymize users by linking advertising IDs to real-world identities via carrier-level exploits—a technique observed in the 'Dark Cartographer' campaign—poses a severe risk to journalists, activists, and government officials. This capability effectively removes the anonymity provided by standard mobile privacy settings.

Recommendations

Encrygma recommends that high-risk individuals implement strict ad-blocking and content-filtering solutions at the network level. Organizations should adopt a 'Zero Trust' mobile security posture, assuming that standard device protections may be bypassed by zero-click exploits. Furthermore, Encrygma advises security teams to monitor for anomalous outbound traffic from mobile devices that correlates with ad-loading events, as this is a primary indicator of potential compromise.