Malware

BH Alert

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Once users click one of these links, they're taken to a fake Google Play page posing as a Bahraini government entity such as Bahrain Civil Defense, the Ministry of Interior, and the Information and eGovernment Authority.

Execution

1 technique

T1204User ExecutionEvidence1

Once the user installs and opens the application, the four-stage malware delivery kicks off.

Stealth

1 technique

T1036MasqueradingEvidence1

The app poses as an official civil defense application, using bilingual (English/Arabic) content that impersonates Bahrain Civil Defense and the Ministry of Interior, with references to UNDRR adding false legitimacy.

Credential Access

1 technique

T1056Input CaptureEvidence1

a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts, and screenshots, running banking-app overlays, and taking full remote control of the device

Collection

2 techniques

T1056Input CaptureEvidence1

T1113Screen CaptureEvidence1

a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts, and screenshots

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app23 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

Aug 18, 2026

Octagon Can Steal SMS One-Time Codes During Banking and Crypto Account Takeovers

Related campaign/payload tied to a Bahrain-themed operation using fake government and Google Play pages with a multi-stage APK infection chain.

dark readingNews

Jul 22, 2026

Fake Bahrain Alert App Deploys Android Surveillance Malware

A fake Bahraini emergency alert Android app distributed via cloned Google Play and government-themed sites. It delivers a four-stage surveillance platform that harvests lockscreen credentials, SMS and one-time codes, contacts, screenshots, supports banking-app overlays, and enables full remote control of the device.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

BH Alert

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Execution

1 technique

T1204User ExecutionEvidence1

Once the user installs and opens the application, the four-stage malware delivery kicks off.

Stealth

1 technique

T1036MasqueradingEvidence1

Credential Access

1 technique

T1056Input CaptureEvidence1

Collection

2 techniques

T1056Input CaptureEvidence1

T1113Screen CaptureEvidence1

a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts, and screenshots

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app23 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

Aug 18, 2026

Octagon Can Steal SMS One-Time Codes During Banking and Crypto Account Takeovers

Related campaign/payload tied to a Bahrain-themed operation using fake government and Google Play pages with a multi-stage APK infection chain.

dark readingNews

Jul 22, 2026

Fake Bahrain Alert App Deploys Android Surveillance Malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.