Loading malware…
SpyDealer is an Android surveillance malware family associated with targeted espionage activity. It has been linked to operations involving the Luoyu cluster, with reporting noting overlap with XDealer and use alongside WinDealer in campaigns delivering platform-specific implants. SpyDealer is designed for covert collection from compromised mobile devices and supports persistence by registering Android broadcast receivers that trigger execution on device boot events.
Its observed surveillance capabilities include harvesting phone call history, SMS and MMS messages, contact lists, and device-identifying subscriber information such as the phone number, IMEI, and IMSI. SpyDealer can also record phone calls and ambient audio through the device microphone, and it supports camera-based surveillance by taking photos and recording video with both front and rear cameras. These behaviors are consistent with a mobile spyware implant intended for long-term monitoring of victims.
SpyDealer targets the Android platform and has been distributed through malicious mobile applications. Its functionality and campaign associations indicate use in espionage-oriented intrusions rather than commodity cybercrime.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Our colleague, who was previously involved in the research of Luoyu, shared with us the insights on this association, particularly the sharing of an encryption key between an old XDealer sample and a SpyDealer sample — suggesting a connection between both malware families.
Confirmed also via malicious mobile applications distributing SpyDealer for Android... Malware and Tools: WinDealer (Windows backdoor primary implant), SpyDealer (Android surveillance malware), custom passive MOTS injection framework operating at network infrastructure level.
...deliver malware like WinDealer (for Windows) and SpyDealer (for Android)...
4 distinct techniques documented for this family, organized by ATT&CK tactic.
EventBot registers for the BOOT_COMPLETED intent to auto-start after the device boots. Pegasus for Android listens for the BOOT_COMPLETED broadcast intent in order to maintain persistence and activate its functionality at device boot time.
EventBot registers for the BOOT_COMPLETED intent to auto-start after the device boots. Pegasus for Android listens for the BOOT_COMPLETED broadcast intent in order to maintain persistence and activate its functionality at device boot time.
victims directed to convincing replicas that trigger automatic download of malicious payloads.
Initial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.
Initial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.