Mercenary Spyware Campaign Escalates: Serbian Officials Targeted via Zero-Click Ad-Injection Exploits

Executive Summary

Encrygma analysts assess with high confidence that a coordinated mercenary spyware campaign has targeted at least 15 high-profile individuals in Serbia, including government prosecutors and academic leaders, ahead of the October 2026 national elections. This operation utilizes sophisticated zero-click delivery mechanisms integrated into legitimate online advertising networks, marking a significant evolution in the tactical deployment of surveillanceware.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, this campaign represents a critical threat level (ETSI 9/10). The attackers have successfully weaponized the 'AdFection' pipeline, a method identified by Encrygma researchers where Discover-Tech infrastructure facilitates the injection of malicious scripts into targeted ad impressions. This allows for device compromise without user interaction, bypassing traditional security awareness training.

Technical Details

Encrygma threat data shows that the campaign employs zero-click exploits developed by vendors such as Candiru and Bindecy. The infection chain begins when a target views an ad served through the Discover-Tech platform. A hidden script tag triggers a connection to an adversary-controlled server, which then delivers the payload. Encrygma analysts have observed that these exploits are designed to be memory-resident, complicating forensic recovery and detection on mobile devices.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the attribution of this campaign as 'High Confidence' regarding the tools used, but 'Moderate' regarding the specific state-sponsored end-user. While the infrastructure is linked to known mercenary spyware vendors, the specific government entity directing the Serbian operations remains under investigation. Encrygma analysts note that the use of Discover-Tech as a 'bridge' vendor is a hallmark of modern, obfuscated surveillance operations.

Implications

Encrygma threat intelligence indicates that the democratization of zero-click capabilities via ad-tech platforms poses a systemic risk to global critical infrastructure. Because these ads are served through standard programmatic channels, they have been observed appearing on networks associated with NATO, defense ministries, and national cyber agencies, creating a massive, persistent exposure surface for high-value targets.

Recommendations

Encrygma recommends that organizations implement gateway-level blocking of ad-tracking domains and utilize Mobile Device Management (MDM) to disable unique advertising identifiers on all corporate-issued devices. Furthermore, Encrygma advises that government and critical infrastructure personnel adopt a 'zero-trust' posture toward mobile browsing, as traditional endpoint protection may be insufficient against these advanced, AI-augmented delivery vectors.