Loading story…
Researchers have identified KidsProtect, an Android surveillance tool marketed online as a parental monitoring app but analyzed as full-featured stalkerware and a remote access trojan. Certo reported the malware is being sold openly on a clear-web hacking forum with subscriptions starting around $60, and said the operator appears to be Greek-speaking based on forum and app artifacts. The spyware can covertly record calls, stream microphone audio, track GPS location, intercept SMS messages and notifications, log keystrokes, access the camera, and view the victim’s screen while hiding behind benign labels such as "WiFi Service".
Analysis found KidsProtect abuses Android Accessibility Service, requests broad permissions, persists across reboots through BootReceiver, and resists removal by registering as a Device Administrator. Researchers said installation guidance includes disabling Google Play Protect, and identified the package name com.example.parentguard as an indicator of compromise. The most significant finding is a white-label reseller model that allows buyers to rebrand and resell the spyware under their own names, a tactic that could frustrate attribution and weaken the impact of enforcement actions that previously disrupted stalkerware operations such as PhoneSpector, Highster Mobile, and TheTruthSpy.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reported on Certo's findings that KidsProtect is openly sold online as stealthy Android stalkerware with subscription pricing starting at $60 and a reseller option that complicates law-enforcement takedowns. The article also noted Certo's assessment that the apparent developer may be Greek-speaking based on forum profile details and in-app screenshots.
Certo disclosed technical details showing KidsProtect abuses Accessibility Service, persists via Device Administrator and reboot mechanisms, disguises itself as apps such as "WiFi Service," and uses the package name com.example.parentguard. The reporting also shared indicators of compromise including listed SHA-256 hashes and warned users to keep Google Play Protect enabled and avoid sideloading APKs.
Certo reported that an Android spyware tool called KidsProtect was being advertised on a clear-web hacking forum as a parental monitoring app while functioning as stalkerware/RAT. The company highlighted its white-label reseller model, which allows buyers to rebrand and resell the malware under their own names.
TechCrunch published a report about newly uncovered victims of TheTruthSpy stalkerware and guidance for Android users to determine whether their devices were compromised. The reference indicates victim discovery as the key development, but provides no further event details in the supplied content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecertosoftware.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed an Android spyware APK named **Process Manager** (package `com.remote.app`) that masquerades as a system component, requests extensive permissions, hides its icon after launch, and persists in the background using device administration features. The malware collects a wide range of information from infected phones, including contacts, call logs, SMS messages, files, clipboard contents, Wi-Fi details, notification content, GPS location, and audio recordings, then packages the data in JSON and sends it to a command-and-control server at `82.146.35[.]240`. The spyware also supports command-based tasking to activate specific collection modules and can download additional payloads from attacker-controlled links. In one observed case, it attempted to install the Play Store app **Roz Dhan: Earn Wallet cash**, apparently to abuse the app’s referral program for profit. Although the C2 infrastructure overlaps with servers previously associated with **Turla** and Penquin-related activity, researchers said the malware’s relatively low sophistication and monetization behavior do not support attributing the operation to Turla.
Aug 15, 2026
Researchers and journalists reported multiple cases in which Android spyware linked to government actors was distributed through official app stores, including **Google Play**. In one campaign, Lookout said North Korean operators deployed spyware it tracks as **KoSpy** through at least one Google Play app and additional listings on APKPure. The malware was built for surveillance, with capabilities to collect **SMS messages, call logs, location data, files, keystrokes, Wi-Fi details, and installed apps**, and to **record audio, take photos, and capture screenshots**. Lookout assessed the operation as highly targeted, likely aimed at specific individuals in South Korea, and linked supporting infrastructure to activity associated with **APT37** and **APT43**. A separate earlier case involved **Exodus**, spyware that researchers found hidden in Google Play apps and described as government malware. Together, the incidents show that official Android marketplaces have been used to deliver surveillance tools masquerading as legitimate apps. Google said it removed the identified KoSpy apps from Google Play, disabled related Firebase projects, and that **Google Play Protect** blocks known versions of the malware.
Jun 29, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026