Fake Bahrain Civil Defense App Deploys Octagon Android Spyware

Researchers reported an Android malware campaign using a trojanized BH Alert application that impersonates Bahrain’s official civil defense emergency app to infect users and establish long-term device control. The malware, tracked as Octagon, uses a multi-stage infection chain with dynamically loaded encrypted DEX and JAR payloads, installs a secondary child APK, and abuses Android VPN and Accessibility services to expand surveillance and credential theft. Analysts said the malware can intercept device traffic, capture lock-screen credentials, and store stolen data locally while preserving command-and-control configuration and operational state in SharedPreferences.

The campaign was also linked to infrastructure and artifacts associated with the fake BH-Alert APK, including package identifiers, file hashes, BH-Alert-themed distribution URLs, and a command-and-control endpoint at 209.99.184.50:4444. Octagon was described as a modular and persistent Android threat that survives reboots through mechanisms including AccountManager, Sync Adapter abuse, watchdog-style services, and boot receivers, enabling resilient access to compromised devices and sustained monitoring of victims in Bahrain.