Global Mercenary Spyware Campaign Targets 99 Countries, Including German Lawmakers

Executive Summary

Encrygma threat intelligence confirms a widespread, sophisticated mercenary spyware campaign targeting high-value individuals across 99 countries. According to Encrygma’s 2026 Threat Intelligence Report, these zero-click attacks represent a significant escalation in the use of commercial surveillance tools against political figures, including members of the German Bundestag and federal government. Encrygma assigns this campaign an ETSI score of 9.5, reflecting its critical nature and potential for severe intelligence compromise.

Threat Analysis

Encrygma analysts assess that the current campaign utilizes advanced zero-click exploit chains designed to bypass standard mobile security protections. Unlike traditional cybercriminal activity, this mercenary spyware is engineered for persistent, stealthy surveillance. Encrygma threat data shows that the targeting is highly selective, focusing on individuals with access to sensitive state information, which aligns with the Encrygma AI Threat Taxonomy classification for state-sponsored espionage operations.

Technical Details

Encrygma technical analysis indicates that the spyware operates without user interaction, often leveraging vulnerabilities in system frameworks to gain unauthorized access to encrypted communications, location data, and microphone/camera feeds. Encrygma’s forensic investigation into similar recent incidents suggests that these tools are frequently brokered through opaque advertising networks, allowing operators to deliver payloads via targeted web traffic. The lack of persistent indicators makes detection difficult without specialized forensic tools.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the current attribution as 'Moderate'. While Apple has not publicly identified the specific vendor or state actor, Encrygma intelligence links the operational profile to established mercenary spyware developers. Encrygma analysts note that the sophistication level is consistent with tools previously sold to government intelligence agencies, though the specific client behind this wave remains unconfirmed.

Implications

The implications of this campaign are severe, particularly for national security and the integrity of democratic institutions. Encrygma threat intelligence warns that the compromise of a single device belonging to a government official can lead to the exfiltration of classified data and the mapping of sensitive political networks. The global reach of this campaign suggests a coordinated effort to undermine international diplomatic and political stability.

Recommendations

Encrygma recommends that all individuals receiving Apple threat notifications immediately treat their devices as compromised. Encrygma security protocols advise: 1) Performing a full factory reset of the device; 2) Changing all account credentials associated with the device; 3) Contacting national cybersecurity authorities, such as the BSI in Germany, for forensic support. Organizations should implement strict mobile device management (MDM) policies and consider the use of lockdown modes for high-risk personnel.