Loading story…
SentinelOne reported that suspected Pakistan-aligned threat actor Transparent Tribe (also tracked as APT36 and Operation C-Major) deployed four new Android CapraRAT samples disguised as entertainment apps targeting mobile gamers, weapons enthusiasts, and TikTok users. The malicious APKs masqueraded as apps including TikTok, Weapons, Crazy Game, and Sexy Videos, using WebView to display legitimate-looking YouTube or CrazyGames[.]com content while requesting extensive high-risk permissions unrelated to their advertised purpose.
The spyware’s core functionality remained consistent with earlier CapraTube activity, but the code was updated to improve compatibility across older Android releases and newer versions including Android 13 and Android 14. Once installed, CapraRAT could collect SMS messages, contacts, call logs, audio recordings, photos, files, and screen or camera data, then exfiltrate the information to infrastructure tied to the group. SentinelOne said all analyzed APKs used the same CapraRAT version identifier and shared command-and-control details including shareboxs[.]net, fallback IP 173[.]249[.]50[.]243, and TCP port 18582.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelLABS reported four new Android APKs linked to Transparent Tribe (APT36/Operation C-Major), continuing the group’s use of themed apps as spyware. The samples expanded lures to target mobile gamers, weapons enthusiasts, and TikTok users while retaining CapraRAT surveillance capabilities and using associated C2 infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that **Transparent Tribe** (also tracked as **APT36**) ran an Android espionage campaign that used trojanized messaging apps, **MeetsApp** and **MeetUp**, to infect people in India and Pakistan who likely had military or political relevance. The operation appears to have relied on honey-trap romance lures, directing targets to fake download sites instead of Google Play, while the apps retained normal chat features to avoid suspicion and covertly installed the **CapraRAT** backdoor. Once installed, the malware enabled broad surveillance, including screenshots, photo capture, audio and call recording, SMS access, contact theft, file exfiltration, and location tracking. ESET linked the activity to Transparent Tribe through reused CapraRAT code, shared command-and-control infrastructure, the same signing certificate, and overlap with domains previously tied to the group; researchers also said poor operator security exposed victim data, allowing them to identify more than 150 victims across India, Pakistan, Russia, Oman, and Egypt.
Jul 12, 2026
Researchers reported that Pakistani-linked espionage operations continued to target Indian defense, government, police, and technology-related personnel with evolving malware delivered through spear phishing, social engineering, and trojanized applications. Cisco Talos said **Operation Celestial Force**, attributed to the **Cosmic Leopard** cluster, has run since at least 2018 and uses a cross-platform toolset including **GravityRAT** for Windows and Android, the **HeavyLift** Electron-based loader, and the **GravityAdmin** campaign management utility. Earlier Securelist research showed GravityRAT had already expanded from Windows into **Android** and **macOS**, using fake apps and spoofed update domains to steal device data, messages, call logs, documents, screenshots, keystrokes, and other files while maintaining persistence and enabling remote command execution. Separate reporting tied **APT36 / Transparent Tribe / Mythic Leopard** to parallel campaigns against Indian military and government targets using counterfeit apps and themed lures. Securelist documented trojanized Android apps, including a fake **Aarogya Setu** app, that deployed a modified **AhMyth** RAT capable of downloading additional APKs, recording audio, deleting selected SMS messages, and exfiltrating contacts, WhatsApp media, documents, and other data. BleepingComputer, citing Talos, also described fake **Kavach** authentication apps used to infect Indian government employees with updated **CrimsonRAT** and a lightweight .NET RAT, underscoring a sustained effort to refine mobile and desktop surveillance malware for intelligence collection.
Aug 15, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026