Fake Bahrain Civil Defense App Spreads Android RAT for Credential and SMS Theft

A malicious Android app masquerading as Bahrain Civil Defense's "BH Alert" emergency application is being distributed through fake Google Play pages and spoofed Bahraini government websites, with researchers saying the campaign is designed to exploit public anxiety during regional missile strikes and civil-defense alerts. Victims are reportedly lured via smishing, social media, and messaging links to sideload a rogue APK outside official app stores, where demand for emergency-alert apps has surged across Bahrain, Kuwait, and other Gulf states.

Researchers at Dream Research Lab said the app uses a four-stage infection chain that deploys OctagonPanel malware and the Ward framework, giving attackers broad surveillance and remote-access capabilities. The malware can steal lock-screen PINs, one-time passwords, SMS messages, banking credentials, contacts, call logs, and screenshots, while also using banking overlays, Accessibility Services abuse, watchdog processes, boot receivers, runtime code injection, and RC4-encrypted payloads hidden in font files to maintain persistence and evade detection. Analysts warned that infected employee phones could help attackers bypass MFA and reach corporate applications, and recommended MDM controls to block sideloading, restrict app execution, and monitor for the malware's roughly five-second command-and-control heartbeat.