SpyDealer
SpyDealer is an Android surveillance malware family used for mobile espionage. The provided content states that it harvests the victim device phone number, IMEI, and IMSI; steals SMS and MMS messages; collects phone call history; harvests contact lists; and can record video and take photos using the front and rear cameras. The content also notes malicious mobile applications distributing SpyDealer for Android. SpyDealer is associated in the reporting with the China-nexus intrusion set SinisterEye/LuoYu, which was described as using ISP-level or backbone-level interception on ChinaNet AS4134 to deliver WinDealer for Windows and SpyDealer for Android against foreign entities operating inside China. The content further notes a reported connection between SpyDealer and XDealer based on the sharing of an encryption key between an older XDealer sample and a SpyDealer sample, suggesting a relationship between the two malware families.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Our colleague, who was previously involved in the research of Luoyu, shared with us the insights on this association, particularly the sharing of an encryption key between an old XDealer sample and a SpyDealer sample — suggesting a connection between both malware families.
Confirmed also via malicious mobile applications distributing SpyDealer for Android... Malware and Tools: WinDealer (Windows backdoor primary implant), SpyDealer (Android surveillance malware), custom passive MOTS injection framework operating at network infrastructure level.
...deliver malware like WinDealer (for Windows) and SpyDealer (for Android)...
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth
1 techniquevictims directed to convincing replicas that trigger automatic download of malicious payloads.
Credential Access
1 techniqueInitial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
Discovery
1 techniqueAbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.
Collection
1 techniqueInitial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android surveillance malware used to monitor targeted individuals in SinisterEye operations.
Android malware delivered in campaigns leveraging adversary-in-the-middle update hijacking.
A malware family mentioned in attribution context due to a shared encryption key with an old XDealer sample.
Android malware capable of recording video and taking photos via front and rear cameras.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.