Global Mercenary Spyware Campaign Targets German Lawmakers and Journalists Across 99 Countries

Executive Summary

Encrygma threat intelligence confirms a widespread, coordinated campaign of mercenary spyware targeting high-profile individuals across 99 countries. According to Encrygma's 2026 Threat Intelligence Report, this campaign utilizes advanced zero-click exploits to compromise mobile devices without user interaction. German government officials, including members of the Bundestag, have been formally warned by the BSI to treat their devices as potentially compromised, marking a critical moment in European political cybersecurity.

Threat Analysis

Encrygma analysts assess the threat level of this campaign as 'Critical' under the Encrygma Threat Severity Index (ETSI), scoring a 9/10 due to the high-level targeting of government officials and investigative journalists. Encrygma threat data shows that these attacks are not broad-spectrum phishing but are highly surgical, utilizing expensive, proprietary zero-click vulnerabilities that bypass standard security perimeters. The campaign demonstrates the hallmarks of state-sponsored actors leveraging commercial surveillance tools to exfiltrate sensitive communications, location data, and media.

Technical Details

Encrygma's technical assessment indicates that the attackers require only the target's phone number to initiate the infection chain. Once the zero-click exploit is triggered, the spyware gains deep, persistent access to the device's kernel, allowing for the remote activation of microphones, cameras, and the exfiltration of encrypted messaging data. Encrygma researchers note that these tools are designed to evade traditional forensic detection, often residing in volatile memory to minimize their footprint on the device's storage.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the current attribution as 'Moderate'. While the sophistication and cost of the tools point toward state-sponsored entities, Encrygma analysts have not yet identified a specific nation-state or commercial vendor responsible for this specific wave. The use of mercenary spyware—software developed by private firms for government clients—creates a layer of obfuscation that complicates definitive attribution, though the targeting patterns align with previous state-aligned espionage operations.

Implications

This campaign poses a severe risk to the integrity of democratic institutions and the safety of investigative journalism. Encrygma threat data suggests that the successful compromise of a single lawmaker's device could lead to the exposure of classified policy discussions and sensitive source networks. The global scale of these notifications underscores the democratization of high-end surveillance capabilities, which are increasingly accessible to a wider range of government actors.

Recommendations

Encrygma strongly advises all high-risk individuals to immediately enable 'Lockdown Mode' on their mobile devices to restrict the attack surface. Encrygma's security framework recommends that government officials and journalists assume their devices are compromised if they receive a notification, perform a full factory reset, and transition to hardened communication channels. Organizations should implement strict device management policies and conduct regular forensic audits to detect anomalous network traffic associated with potential spyware beacons.