Loading malware…
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Once users click one of these links, they're taken to a fake Google Play page posing as a Bahraini government entity such as Bahrain Civil Defense, the Ministry of Interior, and the Information and eGovernment Authority.
Once the user installs and opens the application, the four-stage malware delivery kicks off.
The app poses as an official civil defense application, using bilingual (English/Arabic) content that impersonates Bahrain Civil Defense and the Ministry of Interior, with references to UNDRR adding false legitimacy.
a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts, and screenshots, running banking-app overlays, and taking full remote control of the device
a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts, and screenshots, running banking-app overlays, and taking full remote control of the device
a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts, and screenshots
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.