SecuriTricks - spyware

GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices

A sophisticated Android dropper impersonating the Google Play Store was discovered, distributing an app called 'GPT Trade'. This malicious application, disguised as an AI trading assistant, actually deploys two dangerous payloads: BTMob spyware and UASecurity Miner. The dropper creates directories,…

social engineering

android

Published: November 19, 2025

Downloadable IOCs: 10

Fantasy Hub: Another Russian Based RAT as Malware-as-a-Service

A new Android Remote Access Trojan called Fantasy Hub has been identified, sold on Russian-language channels as a Malware-as-a-Service (MaaS) subscription. The malware offers extensive device control and espionage capabilities, including SMS exfiltration, contact theft, call log access, and bulk im…

Published: November 10, 2025

Downloadable IOCs: 169

New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

Unit 42 researchers have uncovered LANDFALL, a previously unknown Android spyware family targeting Samsung Galaxy devices. The spyware exploits CVE-2025-21042, a zero-day vulnerability in Samsung's image processing library, to deliver commercial-grade surveillance capabilities. LANDFALL is embedded…

Published: November 7, 2025

Downloadable IOCs: 18

ClayRat: A New Android Spyware Targeting Russia

ClayRat is a rapidly evolving Android spyware campaign primarily targeting Russian users. Distributed through Telegram channels and phishing sites, it masquerades as popular apps to lure victims. The spyware can exfiltrate SMS messages, call logs, notifications, and device information, as well as t…

Published: October 10, 2025

Downloadable IOCs: 857

New spyware campaigns target privacy-conscious Android users in the UAE

Two Android spyware campaigns, ProSpy and ToSpy, have been discovered targeting users in the United Arab Emirates. These campaigns impersonate secure messaging apps like Signal and ToTok, distributing malware through deceptive websites and social engineering tactics. Once installed, the spyware exf…

Published: October 2, 2025

Downloadable IOCs: 30

Datzbro: RAT Hiding Behind Senior Travel Scams

A new Android Trojan named Datzbro has been discovered targeting seniors through fake Facebook groups promoting travel and social activities. The malware, which combines spyware and banking Trojan capabilities, is distributed via malicious APKs disguised as community apps. Datzbro features remote a…

Published: September 30, 2025

Downloadable IOCs: 0

The Price of Trust: Analyzing the Malware Campaign Exploiting TASPEN's Legacy to Target Indonesian Senior Citizens

A sophisticated mobile malware campaign is targeting Indonesian pensioners by impersonating TASPEN, the state pension fund. The attackers use a phishing website to distribute a malicious Android app that steals banking credentials, intercepts SMS messages for OTPs, and captures biometric data. The …

Published: August 27, 2025

Downloadable IOCs: 7

Android backdoor spies on Russian business employees

A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging…

android.backdoor.916.origin

targeted-attack

Published: August 25, 2025

Downloadable IOCs: 0

Legitimate Chrome VPN Extension Turns to Browser Spyware

Published: August 19, 2025

Downloadable IOCs: 3

Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads

An unidentified spyware called Batavia has been targeting Russian industrial organizations since July 2024 through a sophisticated phishing operation. The campaign uses bait emails disguised as contract agreements to trick employees into downloading malicious scripts, initiating a multi-stage infec…

persistence mechanisms

russian targets

vbs scripts

delphi executable

Published: July 9, 2025

Downloadable IOCs: 2

Batavia spyware steals data from Russian organizations

The Batavia spyware campaign, active since July 2024, targets Russian industrial enterprises through phishing emails containing malicious links disguised as contract documents. The infection process involves three stages: a VBS script downloader, the WebView.exe spyware, and the javav.exe module. T…

phishing

spyware

uac bypass

multi-stage infection

Published: July 7, 2025

Downloadable IOCs: 2

The new SparkKitty Trojan spy in the App Store and Google Play

A new spyware campaign dubbed SparkKitty has been discovered targeting both iOS and Android devices. The malware, believed to be connected to the previously identified SparkCat campaign, is distributed through official app stores and unofficial sources. It primarily steals photos from infected devi…

Published: June 23, 2025

Downloadable IOCs: 20

Caught in the Act: Uncovering SpyNote in Unexpected Places

Multiple samples of SpyNote, a sophisticated Android spyware, were discovered in open directories, disguised as legitimate apps like Google Translate, Temp Mail, and Deutsche Postbank. The malware exploits accessibility services and device administrator privileges to steal sensitive information fro…

accessibility services

2025-06-20

device administrator

malicious apps

Published: June 20, 2025

Downloadable IOCs: 2

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber

APT36, also known as Transparent Tribe, has been observed using VPS provider Contabo to host malicious infrastructure for CapraRAT and Crimson RAT. Their latest tactic involves disguising spyware as the popular messaging app Viber, granting extensive permissions to record calls, read messages, and …

Published: June 3, 2025

Downloadable IOCs: 3

North Korean APT37 Mobile Spyware Discovered

A new Android spyware called KoSpy has been attributed to the North Korean group APT37 (ScarCruft). The malware, active since March 2022, targets Korean and English-speaking users by masquerading as utility apps. KoSpy uses a two-stage C2 infrastructure, retrieving initial configurations from Fireb…

Published: April 12, 2025

Downloadable IOCs: 0

Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations

The report investigates Paragon Solutions, an Israeli spyware company founded in 2019 that sells a product called Graphite. Through infrastructure analysis, the researchers identified potential Paragon deployments in several countries. They also found evidence linking Paragon to the Canadian Ontari…

Published: March 19, 2025

Downloadable IOCs: 22

Hackers Hijack JFK File Release: Malware & Phishing Surge

A potentially growing cyber threat campaign has been uncovered surrounding the release of declassified JFK, RFK, and MLK files. Attackers are exploiting public interest in these historical documents to launch malware campaigns, phishing schemes, and exploit attempts. Within days of the announcement…

Published: February 3, 2025

Downloadable IOCs: 4

ANDROID MALWARE IN DONOT APT OPERATIONS

The DONOT APT group, serving Indian national interests, has deployed Android malware named 'Tanzeem' for intelligence gathering against internal threats. The malware, disguised as a chat application, exploits OneSignal, a customer engagement platform, for malicious purposes. It requests dangerous p…

Published: January 21, 2025

Downloadable IOCs: 6

PlainGnome and Bonespy Russian Android spyware discovered | Threat Intel

Two Android surveillance families, BoneSpy and PlainGnome, have been discovered and attributed to the Russian Gamaredon APT group, associated with the FSB. BoneSpy, active since 2021, is based on open-source DroidWatcher, while PlainGnome emerged in 2024. Both target Russian-speaking victims in for…

Published: December 13, 2024

Downloadable IOCs: 31

Something to Remember Us By: Device Confiscated by Russian Authorities Returned with Monokle-Type Spyware Installed

A joint investigation by The First Department and The Citizen Lab uncovered spyware covertly implanted on a Russian programmer's phone after it was confiscated by authorities. The individual, accused of sending money to Ukraine, was subjected to beatings and recruitment attempts by the FSB during h…

Published: December 5, 2024

Downloadable IOCs: 0

New Android Spyware Campaign Targets South Koreans via AWS

A sophisticated Android spyware campaign targeting South Koreans has been uncovered by Cyble Research and Intelligence Labs. Active since June 2024, the malware exploits an Amazon AWS S3 bucket as its Command and Control server to exfiltrate sensitive personal data including SMS messages, contacts,…

Published: October 1, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21893

Downloadable IOCs: 7

EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

Kaspersky detected an ongoing targeted cyberattack campaign, dubbed EastWind, targeting Russian government organizations and IT companies. The attackers employed phishing emails with malicious shortcuts to deliver malware that communicated via Dropbox. They utilized tools associated with APT31 and …

Published: August 14, 2024

Downloadable IOCs: 5

LianSpy: new Android spyware targeting Russian users

Kaspersky discovered an Android spyware campaign called LianSpy that targets Russian users. The malware can capture screencasts, exfiltrate files, and harvest call logs and app lists. It employs evasive tactics like using the Russian cloud service Yandex Disk for command and control communication, …

Published: August 6, 2024

Downloadable IOCs: 0

New Mandrake Android spyware version discovered on Google Play

n April 2024, Securelist discovered a suspicious sample that appeared to be a new version of Mandrake. Ensuing analysis revealed as many as five Mandrake applications, which had been available on Google Play from 2022 to 2024 with more than 32,000 installs in total, while staying undetected by any …

Published: July 29, 2024

Downloadable IOCs: 9

The tapestry of threats targeting Hamster Kombat players

This analysis delves into the various malicious threats capitalizing on the immense popularity of the Hamster Kombat mobile game. It reveals that cybercriminals are exploiting players' interests by distributing Android spyware disguised as the game through unofficial channels, as well as creating f…

android

spyware

2024-07-24

Published: July 24, 2024

Downloadable IOCs: 26

Exploiting CVE-2021-40444 to Infiltrate Systems

A recently detected attack exploited a vulnerability in Microsoft Office to deploy spyware called MerkSpy. The initial vector was a deceptive Word document posing as a job description. Opening it triggered the exploitation of CVE-2021-40444, allowing arbitrary code execution. This downloaded an HTM…

Published: July 2, 2024

Linked vulnerabilities : CVE-2021-40444

Downloadable IOCs: 6

CapraTube Remix | Android Spyware Targeting Gamers, Weapons Enthusiasts

SentinelLabs has uncovered a new campaign of Android spyware apps associated with the suspected Pakistan state-aligned Transparent Tribe threat group. The malicious apps, disguised as video browsers, gaming sites, and TikTok content, target mobile gamers, weapons enthusiasts, and individuals intere…

Published: July 1, 2024

Downloadable IOCs: 6

Arid Viper poisons Android apps with AridSpy

ESET researchers identified five campaigns targeting Android users with trojanized apps that deploy multistage Android spyware called AridSpy. This malware, attributed with medium confidence to the Arid Viper APT group, focuses on user data espionage. AridSpy downloads additional payloads from its …

Published: June 14, 2024

Downloadable IOCs: 37

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

This analysis discusses the emergence of a new macOS malware family called 'Cuckoo Stealer', which acts as an infostealer and spyware. It describes Cuckoo Stealer's main features, logic, and provides indicators of compromise to assist threat hunters and defenders. The malware employs techniques lik…

Published: May 10, 2024

Downloadable IOCs: 4

Malware: Behaves Like Cross Between Infostealer and Spyware

On April 24, 2024, we found a previously undetected malicious Mach-O binary programmed to behave like a cross between spyware and an infostealer. We have named the malware Cuckoo, after the bird that lays its eggs in the nests of other birds and steals the host's resources for the gain of its young.

Published: May 3, 2024

Downloadable IOCs: 18

Tag: spyware

Attack reports

Prolific Zero-Day Exploits Continue

Global Corporate Web

4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign

GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices

Fantasy Hub: Another Russian Based RAT as Malware-as-a-Service

New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

ClayRat: A New Android Spyware Targeting Russia

New spyware campaigns target privacy-conscious Android users in the UAE

Datzbro: RAT Hiding Behind Senior Travel Scams

The Price of Trust: Analyzing the Malware Campaign Exploiting TASPEN's Legacy to Target Indonesian Senior Citizens

Android backdoor spies on Russian business employees

Legitimate Chrome VPN Extension Turns to Browser Spyware

Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads

Batavia spyware steals data from Russian organizations

The new SparkKitty Trojan spy in the App Store and Google Play

Caught in the Act: Uncovering SpyNote in Unexpected Places

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber

North Korean APT37 Mobile Spyware Discovered

Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations

Hackers Hijack JFK File Release: Malware & Phishing Surge

ANDROID MALWARE IN DONOT APT OPERATIONS

PlainGnome and Bonespy Russian Android spyware discovered | Threat Intel

Something to Remember Us By: Device Confiscated by Russian Authorities Returned with Monokle-Type Spyware Installed

New Android Spyware Campaign Targets South Koreans via AWS

EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

LianSpy: new Android spyware targeting Russian users

New Mandrake Android spyware version discovered on Google Play

The tapestry of threats targeting Hamster Kombat players

Exploiting CVE-2021-40444 to Infiltrate Systems

CapraTube Remix | Android Spyware Targeting Gamers, Weapons Enthusiasts

Arid Viper poisons Android apps with AridSpy

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

Malware: Behaves Like Cross Between Infostealer and Spyware