Loading story…
ESET reported that the StrongPity espionage group targeted Android users by distributing trojanized versions of legitimate messaging applications, including Signal and a modified Telegram build, through attacker-controlled websites that mimicked official download pages. The campaign relied on users sideloading the apps outside official stores, allowing the spyware to masquerade as functional software while gaining access to sensitive mobile data.
Once installed, the Android malware could collect a wide range of information from infected devices, including SMS messages, call logs, contact lists, and stored files, and it could also record phone calls and ambient audio. The operation extended StrongPity’s long-running espionage activity from Windows into mobile platforms, underscoring the group’s focus on covert surveillance of individuals through fake app distribution and broad device-level data theft.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ESET disclosed a StrongPity espionage campaign targeting Android users, documenting the activity in a WeLiveSecurity report. The reference indicates the campaign was publicly revealed on the report's publication date.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **StrongPity** espionage group expanded beyond its established Windows malware operations by deploying Android backdoors for the first time, according to research linking the mobile samples to the actor through shared code structure, modular design, file collection behavior, and command-and-control infrastructure. The Android malware was distributed through repackaged legitimate applications, fake apps, and compromised websites, showing that the group was testing multiple infection paths while broadening its surveillance capability to mobile devices. Researchers reported at least two Android trojan variants, with the newer version adding more message types, accessibility and notification components, SQLite-based local storage, service execution triggered by `ScreenReceiver`, and the ability to invoke root-level access via `su` on compromised devices. Infrastructure tied to domains such as `upn-sec3-msd[.]com` and `networktopologymaps[.]com`, along with earlier reporting on **PROMETHIUM/StrongPity** activity, indicates the group was extending its global reach while building modular tooling designed to collect victim data through downloadable components.
Aug 14, 2026
ESET reported that an Android espionage operation dubbed **eXotic Visit** distributed trojanized but working mobile apps—primarily fake messaging services—to deliver the custom **XploitSPY** malware. The campaign was active from at least late 2021 through the end of 2023 and spread through dedicated websites, GitHub, alternative app stores, and **Google Play**. Researchers said the activity appears to have mainly targeted users in **Pakistan** and **India**, and they track the operators as **Virtual Invaders** without a confirmed link to any previously known threat group. The malware gave operators broad surveillance and remote-control access, including theft of contacts, SMS messages, call logs, files, location data, notifications, audio recordings, and photos. ESET said later variants improved stealth with obfuscation, emulator detection, Firebase-based command-and-control retrieval, and native libraries used to conceal C2 details. The company identified about **380 compromised accounts** across some of the malicious apps and reported multiple samples to Google, which removed the affected apps from Google Play.
Aug 14, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a surge in sophisticated spyware campaigns targeting users of popular mobile messaging applications such as Signal, WhatsApp, and Telegram. Threat actors are leveraging commercial spyware and remote access trojans (RATs), employing tactics like social engineering, device-linking QR codes, zero-click exploits, and spoofed app versions to compromise high-value individuals, including government officials. Notable campaigns include the use of Android spyware like ProSpy, ToSpy, and ClayRat, as well as the exploitation of vulnerabilities in iOS, WhatsApp, and Samsung devices to deploy malware such as LANDFALL, with the goal of persistent access and data exfiltration. In a related development, researchers at Certo Software have identified a new Android RAT dubbed RadzaRat, which masquerades as a legitimate file manager app. RadzaRat provides attackers with full remote control over infected devices, supports large-scale file transfers, and features keylogging capabilities to steal sensitive information. Alarmingly, RadzaRat is currently undetectable by all major antivirus solutions and is openly available for download, increasing the risk of widespread abuse. These findings underscore the growing threat posed by advanced spyware and RATs targeting mobile platforms, often bypassing traditional security defenses and exploiting user trust in legitimate-looking applications.
Jun 29, 2026