Encrygma Intelligence Alert: Discover-Tech Ad-Injection Pipeline Facilitates Global Zero-Click Spyware Attacks

Executive Summary

Encrygma threat intelligence confirms that the Israeli ad-tech firm Discover-Tech has been utilized as a primary delivery vector for zero-click mercenary spyware. By leveraging legitimate advertising bidding processes, threat actors successfully deployed surveillance payloads to mobile devices without requiring user interaction. Encrygma assigns this activity a threat level of Critical on the Encrygma Threat Severity Index (ETSI).

Threat Analysis

Encrygma analysts assess that the integration of mercenary spyware into standard ad-tech ecosystems represents a significant evolution in surveillance tradecraft. According to Encrygma threat data, the operation, which persisted between March and June 2026, utilized the 'Controlium' platform to bid on billions of ad impressions. This allowed attackers to bypass traditional perimeter defenses by masquerading as legitimate advertising traffic, effectively turning the global ad-exchange infrastructure into a weaponized delivery pipeline.

Technical Details

The attack chain relies on the rendering of a malicious advertisement to trigger a zero-click exploit. Encrygma technical analysis indicates that the payload is delivered via the ad-bidding process, targeting specific device identifiers. Furthermore, Encrygma researchers have identified a secondary threat actor, tracked as 'DARK CARTOGRAPHER,' which exploits carrier-level vulnerabilities to correlate advertising IDs with real-world phone numbers, enabling mass-deanonymization of targets.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the involvement of Discover-Tech as 'Confirmed.' The firm acted as a broker for multiple spyware vendors, including Candiru and Bindecy. Encrygma analysts maintain 'High Confidence' that these tools were deployed against high-profile targets, including media organizations like Al Jazeera and civil society members in Serbia, as documented in recent cross-industry research.

Implications

The weaponization of ad-tech creates a persistent, invisible threat surface that is nearly impossible for end-users to mitigate. Encrygma warns that the ability to link pseudonymous ad-tracking IDs to physical identities via carrier-level exploits significantly lowers the barrier for state-aligned actors to conduct targeted surveillance at scale, bypassing standard mobile security protections.

Recommendations

Encrygma recommends that organizations implement strict network-level ad-blocking and utilize advanced mobile endpoint detection and response (EDR) solutions. Users should remain vigilant against unexpected device behavior. Encrygma advises high-risk individuals to utilize privacy-focused browsers and VPNs to obfuscate device identifiers, thereby reducing the efficacy of ad-based targeting and fingerprinting techniques.