Loading story…
Researchers analyzed an Android spyware APK named Process Manager (package com.remote.app) that masquerades as a system component, requests extensive permissions, hides its icon after launch, and persists in the background using device administration features. The malware collects a wide range of information from infected phones, including contacts, call logs, SMS messages, files, clipboard contents, Wi-Fi details, notification content, GPS location, and audio recordings, then packages the data in JSON and sends it to a command-and-control server at 82.146.35[.]240.
The spyware also supports command-based tasking to activate specific collection modules and can download additional payloads from attacker-controlled links. In one observed case, it attempted to install the Play Store app Roz Dhan: Earn Wallet cash, apparently to abuse the app’s referral program for profit. Although the C2 infrastructure overlaps with servers previously associated with Turla and Penquin-related activity, researchers said the malware’s relatively low sophistication and monetization behavior do not support attributing the operation to Turla.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The BleepingComputer article was updated to clarify that the reported connection to Turla relied on weak evidence rather than firm attribution.
Lab52 observed the malware downloading the Google Play app "Roz Dhan: Earn Wallet cash," apparently to abuse its referral system and generate commissions for the operators.
Despite the infrastructure overlap, the researchers concluded attribution of the Android spyware to Turla was not possible based on the malware's capabilities and low sophistication, suggesting shared infrastructure instead.
During the analysis, Lab52 found the spyware communicated with 82.146.35[.]240, infrastructure previously associated with Penquin-related activity and other servers used in Turla-linked operations.
Lab52 discovered a malicious Android APK named "Process Manager" on VirusTotal and analyzed it as spyware that disguises itself as a system component, requests extensive permissions, hides its icon, and exfiltrates data to 82.146.35[.]240.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT-C-23, also known as **Two-tailed Scorpion** or **C-23**, deployed updated Android spyware against users in the Middle East, with reporting pointing to victims especially in the Palestinian Territories. The malware was disguised as benign update or installer apps, including **"App Updates," "System Apps Updates," "Android Update Intelligence,"** and a fake Google Play or Telegram-themed application using the package name `org.telegram.light`. Researchers said the campaign likely relied on phishing links sent by SMS and fake Android app stores to trick targets into installing the spyware and granting high-risk permissions such as device administrator, notification access, accessibility monitoring, and third-party app installation. The newer variants expanded both stealth and resilience. After installation, the spyware could rename itself and swap icons to resemble trusted apps such as **Google Play**, **YouTube**, **Google**, or **Botim**, making removal harder for victims. It also supported post-deployment command-and-control updates and Firebase-based messaging to maintain communications if infrastructure changed. Once active, the malware could exfiltrate SMS messages, contacts, call logs, files, screenshots, audio recordings, pictures, and notifications from messaging apps including WhatsApp, while also placing calls, disabling Wi‑Fi, and in some cases deleting device data.
Aug 15, 2026
Researchers reported that **BTMob** is operating as an Android banking malware and fraud-as-a-service platform that lets multiple criminal actors create branded malicious apps and run large-scale device-takeover campaigns. Analysis of leaked source packages and exposed infrastructure linked the operation to roughly **1,400 live servers**, including command-and-control nodes, an automated APK-building ecosystem, and backend components used to manage victim infections and operator access. The platform is being spread through fake apps, cloned download pages, and social-engineering lures, including WhatsApp messages and phone calls in Brazil that pressure victims to sideload APKs and grant dangerous permissions. Investigators tied the activity to infrastructure using `/yaarsa/` PHP backend paths, HTTP and WebSocket endpoints, a control panel on port `3000` identified by the string **"painel de controle elite"**, and payloads including `lnat-tv-pro.apk`, `BTMob.exe`, `SolrStarter.exe`, and `SolrWorker.exe`, while also linking the operation to the earlier **CraxsRAT** and **SpySolr** malware families.
Aug 22, 2026
Researchers identified **PromptSpy**, a newly disclosed Android spyware and remote access trojan that uses **Google Gemini** during runtime to interpret on-screen elements and decide which gestures to perform on an infected device. The malware can steal lockscreen PINs and passwords, enumerate installed apps, capture screenshots, record video, and give operators live remote screen control over encrypted communications. Investigators said the AI-assisted navigation appears to be the first reported case of mobile malware directly invoking generative AI on a victim device while executing. PromptSpy was discovered by ESET during an investigation into a separate AI-enabled ransomware case and was distributed through a fake Argentine banking-themed website using app names such as **MorganArg** and **MorganArgs**, impersonating a JPMorgan Chase Argentina branch app. Telemetry indicates limited real-world deployment, with one confirmed detection in Ukraine in February 2026, suggesting the malware may still be an early-stage proof of concept. The spyware abuses Android accessibility services to keep itself pinned in the recent apps list and to hinder removal by placing invisible overlays over the **Stop** and **Uninstall** buttons, while Google Threat Intelligence Group said its Gemini-driven interaction is broader than persistence alone and that components including API keys can be updated remotely through command-and-control.
Jul 9, 2026