Loading story…
The Bahamut cybermercenary group ran a targeted Android espionage campaign that distributed spyware through a fake SecureVPN website, using trojanized versions of legitimate VPN applications to infect victims. Researchers said the operation had been active since at least January 2022 and initially repackaged SoftVPN before later shifting to OpenVPN, embedding Bahamut spyware while gating execution with an activation-key mechanism that likely restricted infections to selected targets.
The malware was built for covert surveillance and data theft, with capabilities to collect contacts, SMS messages, call logs, location data, device details, installed-app lists, and files, as well as record phone calls. It also abused Android accessibility services to monitor messaging apps and enable keylogging. Investigators identified at least eight malware variants and linked the fake VPN infrastructure to earlier Bahamut activity through code overlap and operational similarities with prior SecureChat campaigns, reinforcing the assessment that the operation was low-volume, highly targeted, and designed for espionage rather than mass distribution.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
ESET listed ft8hua063okwfdcu21pw[.]de at 104.21.10[.]79 as a command-and-control server associated with the campaign. The server was first seen on this date.
The first analyzed fake SecureVPN sample was uploaded to VirusTotal from an IP address geolocating to Singapore. This provided an early public artifact of the campaign's malware.
The domain thesecurevpn[.]com, used to distribute Bahamut's trojanized Android VPN apps, was registered. ESET later tied this infrastructure to the targeted spyware campaign.
ESET reported that Bahamut's Android espionage campaign had been running since at least January 2022. The operation used fake SecureVPN-branded apps to target victims with spyware.
ESET publicly described an active, highly targeted Android spyware campaign attributed to the Bahamut APT group. The report said the attackers distributed trojanized SoftVPN and OpenVPN apps via a fake SecureVPN website and identified at least eight malware versions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Bahamut** threat group ran Android espionage campaigns that used phishing websites to trick victims into installing malicious APKs disguised as religious community apps, secure messaging tools, and other themed applications. Researchers linked the activity to domains including `jamaat-ul-islam[.]com`, `jamatapplication[.]com`, `jamaatforummah[.]com`, `jamaatforallah[.]com`, and `securechatnow.com`, with targeting focused on users in the Middle East and South Asia. The lures impersonated trusted services and communities to deliver spyware under names such as **"Chat Services"** and counterfeit Jamaat chat apps. Once installed, the malware sought extensive Android permissions and abused **Accessibility Service** to conduct broad surveillance on infected devices. It collected contacts, SMS messages, call logs, files, location data, audio, device identifiers, and notification content, and newer variants expanded collection to messaging platforms including **WhatsApp, Signal, Telegram, Viber, Imo, Facebook Messenger, ProtectedText,** and Tor-related chat apps. Stolen data was stored locally and exfiltrated to command-and-control infrastructure over **HTTPS** using **Socket.IO**, with uploads triggered by device events and on a recurring four-hour schedule.
Aug 14, 2026
Researchers reported an Android malware campaign using a trojanized **BH Alert** application that impersonates Bahrain’s official civil defense emergency app to infect users and establish long-term device control. The malware, tracked as **Octagon**, uses a multi-stage infection chain with dynamically loaded encrypted `DEX` and `JAR` payloads, installs a secondary child APK, and abuses Android **VPN** and **Accessibility** services to expand surveillance and credential theft. Analysts said the malware can intercept device traffic, capture lock-screen credentials, and store stolen data locally while preserving command-and-control configuration and operational state in `SharedPreferences`. The campaign was also linked to infrastructure and artifacts associated with the fake **BH-Alert** APK, including package identifiers, file hashes, BH-Alert-themed distribution URLs, and a command-and-control endpoint at `209.99.184.50:4444`. Octagon was described as a modular and persistent Android threat that survives reboots through mechanisms including **AccountManager**, **Sync Adapter** abuse, watchdog-style services, and boot receivers, enabling resilient access to compromised devices and sustained monitoring of victims in Bahrain.
Aug 3, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026