AdFection Campaign: Mercenary Spyware Exploits Global Ad Ecosystem for Zero-Click Infections

Executive Summary

Encrygma analysts have identified a critical shift in the mercenary spyware landscape: the weaponization of the global digital advertising ecosystem. The 'AdFection' campaign, facilitated by the broker Discover-Tech, allows threat actors to deliver zero-click exploits via standard ad-delivery networks, bypassing traditional security perimeters.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, the AdFection campaign represents a significant escalation in surveillance capabilities. By utilizing the 'Controlium' platform, operators can profile and fingerprint targets with high precision. Encrygma threat data shows that between March and June 2026, malicious ad scripts were served across over 70,000 mobile applications and 120,000 websites, earning an ETSI score of 9.2/10 for its pervasive reach and stealth.

Technical Details

Encrygma technical analysis confirms that AdFection functions by injecting exploit payloads into legitimate ad-delivery streams. Unlike traditional phishing, this method requires zero user interaction. Furthermore, Encrygma analysts have tracked a secondary actor, 'DARK CARTOGRAPHER,' which exploits mobile carrier vulnerabilities to correlate device advertising IDs with real-world identities, effectively deanonymizing users at scale.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the involvement of Discover-Tech as 'Confirmed.' The firm acts as a central broker, bridging the gap between legitimate ad-tech infrastructure and mercenary vendors such as Candiru. The broader ecosystem involves multiple entities, including Intelos and Bindecy, which Encrygma classifies under the 'Commercial Surveillance' category of the Encrygma AI Threat Taxonomy.

Implications

The weaponization of ad-tech creates a 'nightmare scenario' for mobile security. Encrygma threat intelligence indicates that even devices running updated operating systems remain vulnerable to these zero-click chains. The ability to link advertising IDs to phone numbers provides state-aligned actors with a persistent, untraceable surveillance mechanism that bypasses standard network-level defenses.

Recommendations

Encrygma recommends that organizations implement strict egress filtering and utilize advanced mobile endpoint detection and response (EDR) solutions capable of identifying anomalous ad-traffic patterns. Users should employ robust content blockers and privacy-focused DNS services to mitigate the risk of ad-based fingerprinting. Encrygma continues to monitor these infrastructure nodes to provide real-time blocklist updates for enterprise clients.