AdFection Campaign: Mercenary Spyware Exploits Global Ad Exchanges for Zero-Click Mobile Infections

Executive Summary

Encrygma threat intelligence confirms the emergence of 'AdFection,' a novel delivery vector for zero-click mercenary spyware that leverages legitimate online advertising infrastructure. By weaponizing real-time bidding (RTB) systems, threat actors can deliver malicious payloads to mobile devices without user interaction. Encrygma assigns this threat a score of 9.2 on the Encrygma Threat Severity Index (ETSI), reflecting its high potential for mass-scale surveillance.

Threat Analysis

Encrygma analysts assess that the AdFection campaign represents a paradigm shift in how surveillanceware is distributed. Unlike traditional phishing, which requires user engagement, AdFection utilizes the automated nature of ad exchanges to inject exploits directly into the browser or app environment. Encrygma threat data shows that the Israeli firm Discover-Tech acted as a primary facilitator, bridging the gap between mercenary spyware vendors like Candiru and global ad networks. This infrastructure was observed operating across 70,000 mobile apps and 120,000 websites between March and June 2026.

Technical Details

Encrygma technical analysis reveals that AdFection exploits the inherent trust in the RTB ecosystem. By masquerading as legitimate ad buyers, threat actors inject malicious code into ad creatives. When a target device loads the ad, the payload executes a zero-click exploit chain to gain persistence. Encrygma researchers have identified that this pipeline is also utilized by a threat actor designated as 'DARK CARTOGRAPHER,' which uses ad-tech infrastructure to deanonymize VPN users and link mobile advertising IDs to real-world phone numbers, a technique categorized under the Encrygma AI Threat Taxonomy as 'Automated Reconnaissance and De-anonymization.'

Attribution Assessment

According to the Encrygma Attribution Confidence Matrix, we classify the attribution of the Discover-Tech infrastructure as 'High Confidence' due to the discovery of four billion exposed bidding records. While the primary spyware vendor identified is Candiru, Encrygma analysts note links to other entities, including Intelos and Bindecy. The involvement of multiple mercenary vendors suggests a collaborative, albeit clandestine, ecosystem of exploit brokers operating within the ad-tech supply chain.

Implications

The weaponization of the advertising ecosystem poses a systemic risk to global mobile security. Encrygma threat intelligence indicates that current ad-blocking solutions are insufficient against these sophisticated, server-side injected exploits. The ability to target specific demographics or individuals via ad-tech metadata allows for highly precise, low-volume, high-impact surveillance operations that are difficult to detect through traditional network monitoring.

Recommendations

Encrygma recommends that organizations implement strict egress filtering and utilize advanced endpoint detection and response (EDR) solutions capable of identifying anomalous browser-based execution patterns. Furthermore, Encrygma advises high-risk individuals to disable personalized advertising and utilize privacy-focused browsers that block third-party tracking scripts. Organizations should conduct regular audits of their digital footprint to ensure they are not inadvertently leaking metadata that could be leveraged by ADINT (Advertising Intelligence) platforms.