Loading story…
Cybersecurity researchers have uncovered two sophisticated Android spyware campaigns, ProSpy and ToSpy, that specifically target users in the United Arab Emirates by impersonating popular secure messaging apps Signal and ToTok. The campaigns rely on social engineering and fake websites, including those mimicking the Samsung Galaxy Store, to trick users into manually downloading malicious APK files. Neither ProSpy nor ToSpy is available through official app stores, requiring victims to sideload the apps from third-party sources that appear legitimate. Once installed, the spyware establishes persistent access to the device, enabling continuous exfiltration of sensitive data, including contacts, SMS messages, chat backups, media files, and device information. ESET researchers, who discovered these campaigns, noted that the ProSpy campaign has been active since at least 2024, while ToSpy dates back to 2022, indicating a long-running and evolving threat. The campaigns are regionally focused, with evidence suggesting strategic delivery mechanisms tailored to the UAE, such as the use of domains ending in ae.net and the targeting of users seeking alternatives to banned or restricted messaging services. The ToTok app, which was previously removed from Google Play and Apple App Store in 2019 due to its own surveillance concerns, is used as a lure, exploiting its notoriety and continued demand among Emirati users. The spyware not only steals data but also reloads the authentic apps to maintain the appearance of legitimacy and avoid user suspicion. Command-and-control infrastructure supporting the ToSpy campaign remains active, indicating ongoing operations. Researchers identified multiple malicious APKs built on the same codebase, distributed through at least four deceptive websites. The campaigns leverage the UAE’s unique app ecosystem, where government restrictions on Western messaging apps create opportunities for malicious actors to exploit users seeking secure communication tools. The discovery highlights the persistent threat of mobile spyware in the region and the importance of downloading apps only from trusted sources. ESET’s telemetry and analysis have been critical in mapping the scope and techniques of these campaigns, which continue to pose a significant risk to privacy and security in the UAE. The campaigns demonstrate the adaptability of threat actors in leveraging both technical and social vectors to compromise targets. The use of fake app stores and phishing sites underscores the need for heightened user awareness and robust mobile security practices. The ongoing nature of these campaigns suggests that users in the UAE remain at elevated risk from similar threats in the future.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers identified two Android spyware families, ProSpy and ToSpy, targeting users in the United Arab Emirates by masquerading as trusted messaging-related apps. The campaigns were publicly disclosed across multiple security news reports describing the malware as impersonating Signal-related software and ToTok variants to steal victim data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
11 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcesecurityaffairs.com
Open sourcegovinfosecurity.com
Open sourcesecurityaffairs.com
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a surge in sophisticated spyware campaigns targeting users of popular mobile messaging applications such as Signal, WhatsApp, and Telegram. Threat actors are leveraging commercial spyware and remote access trojans (RATs), employing tactics like social engineering, device-linking QR codes, zero-click exploits, and spoofed app versions to compromise high-value individuals, including government officials. Notable campaigns include the use of Android spyware like ProSpy, ToSpy, and ClayRat, as well as the exploitation of vulnerabilities in iOS, WhatsApp, and Samsung devices to deploy malware such as LANDFALL, with the goal of persistent access and data exfiltration. In a related development, researchers at Certo Software have identified a new Android RAT dubbed RadzaRat, which masquerades as a legitimate file manager app. RadzaRat provides attackers with full remote control over infected devices, supports large-scale file transfers, and features keylogging capabilities to steal sensitive information. Alarmingly, RadzaRat is currently undetectable by all major antivirus solutions and is openly available for download, increasing the risk of widespread abuse. These findings underscore the growing threat posed by advanced spyware and RATs targeting mobile platforms, often bypassing traditional security defenses and exploiting user trust in legitimate-looking applications.
Jun 29, 2026
ESET reported that an Android espionage operation dubbed **eXotic Visit** distributed trojanized but working mobile apps—primarily fake messaging services—to deliver the custom **XploitSPY** malware. The campaign was active from at least late 2021 through the end of 2023 and spread through dedicated websites, GitHub, alternative app stores, and **Google Play**. Researchers said the activity appears to have mainly targeted users in **Pakistan** and **India**, and they track the operators as **Virtual Invaders** without a confirmed link to any previously known threat group. The malware gave operators broad surveillance and remote-control access, including theft of contacts, SMS messages, call logs, files, location data, notifications, audio recordings, and photos. ESET said later variants improved stealth with obfuscation, emulator detection, Firebase-based command-and-control retrieval, and native libraries used to conceal C2 details. The company identified about **380 compromised accounts** across some of the malicious apps and reported multiple samples to Google, which removed the affected apps from Google Play.
Aug 14, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026