Loading malware…
FallSpy is an Android spyware family first observed in August 2025 and associated with the GREYVIBE threat cluster. It has been used in campaigns targeting Ukraine and Ukraine-related victims, including operations known as PrincessClub and Nebo. GREYVIBE’s activity has been assessed as aligned with Russian state intelligence interests in the context of the Russia-Ukraine war, while also showing ties to the broader cybercrime ecosystem.
FallSpy is designed to harvest sensitive information from compromised Android devices. Reported collection includes contact lists, call logs, installed application inventories, SIM-linked phone numbers, device and network information, Wi-Fi details, last-known location data, public-facing network information, and media files. Its role in observed operations is intelligence collection from mobile devices, particularly against victims reached through socially engineered lure infrastructure.
Observed delivery has relied on fraudulent websites and tailored social engineering. In the PrincessClub campaign, fake Ukrainian adult-club websites delivered FallSpy to Android users, while parallel Windows-targeted payloads were served to desktop victims. Operators also used fake female personas on Telegram and local dating channels to build trust and direct targets to lure sites or deliver malware directly. In the Nebo campaign, a FallSpy sample was crafted to mimic a Russian-language military login interface, apparently to deceive Ukrainian military personnel. Confirmed victimology linked to associated campaigns includes Ukrainian combatants, with broader GREYVIBE targeting spanning military, government, civilian, and business-related entities.
FallSpy forms part of a wider GREYVIBE malware ecosystem that also includes PhantomRelay and LegionRelay. Administrative artifacts associated with FallSpy have been observed in Russian language, consistent with broader indications that GREYVIBE operators and developers are Russian-speaking and operate broadly in the Moscow time zone.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
FallSpy is an Android spyware first observed in August 2025. It has been observed across several GREYVIBE-associated campaigns, including PrincessClub and Nebo.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
For example, the custom FallSpy Android malware extracts local contact lists and call logs.
The group has used fake female personas on Telegram, including via local dating channels, to build trust with victims before directing them to the lure sites or delivering malware directly.
The group has leveraged multiple attack vectors, including... fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware... PrincessClub... fake Ukrainian adult-club websites that deliver Android spyware called FallSpy, or Windows-based RATs depending on the victim’s device.
The group has leveraged multiple attack vectors, including spear-phishing e-mails, fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware to a diverse set of victims.
Across these campaigns, the group has relied on custom developed obfuscators, loaders, and malware... WithSecure found evidence of AI assistance across multiple parts of the operation... obfuscation scripts...
Associated domains masqueraded as Zoom conference and LAPAS (Latvian Platform for Development Cooperation) websites.
The malware presents decoy content to the victim while covertly collecting and exfiltrating information from the victim’s device, including contacts, call logs, installed applications, SIM-linked phone numbers, device and network information, Wi-Fi SSID, last-known location, public IP, and media files.
The malware presents decoy content to the victim while covertly collecting and exfiltrating information from the victim’s device, including contacts, call logs, installed applications, SIM-linked phone numbers, device and network information...
PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client.
Later iterations of the lure sites introduced a WebRTC-based live call feature, accessible only post-infection, that could capture victim audio and video, turning the lure site from a static decoy into a potential human intelligence (HUMINT) collection mechanism.
Later iterations of the lure sites introduced a WebRTC-based live call feature, accessible only post-infection, that could capture victim audio and video, turning the lure site from a static decoy into a potential human intelligence (HUMINT) collection mechanism.
LegionRelay is a lightweight PowerShell-based RAT that supports ... file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration...
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.