Loading story…
Google's Threat Analysis Group said Cytrox's Predator spyware was deployed in three 2021 campaigns that chained five zero-day vulnerabilities across Chrome and Android to compromise fully updated Android devices, including Samsung phones. The attacks used one-time spear-phishing links sent by email, redirected victims through attacker-controlled domains, and then forwarded them to legitimate websites after exploitation. Google said the exploit chains included Chrome sandbox escapes, Android privilege-escalation flaws, and in some cases a Samsung browser pivot, allowing operators to install the Alien malware first and then load the Predator implant.
Google assessed with high confidence that Cytrox, a North Macedonian spyware vendor, packaged the exploits and sold them to multiple government-backed customers linked to Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain, and Indonesia. The campaigns were described as limited in scale, targeting only tens of users, but the spyware gave operators extensive surveillance access, including the ability to record audio, add CA certificates, and hide apps. Google's findings aligned with earlier Citizen Lab reporting that identified Predator on the phone of exiled Egyptian politician Ayman Nour, underscoring the growing commercial market for mercenary spyware and delayed patching risks such as CVE-2021-1048.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Google's Threat Analysis Group announced that state-backed actors used five zero-day vulnerabilities across Chrome and Android in three 2021 campaigns to install Cytrox's Predator spyware on fully updated Android devices. Google said Cytrox packaged the exploits and sold them to multiple government-backed customers linked to Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain, and Indonesia.
Meta disclosed in December 2021 that it removed about 300 Facebook and Instagram accounts used by Cytrox in compromise campaigns.
Citizen Lab published a report in December 2021 finding Cytrox's Predator spyware on exiled Egyptian politician Ayman Nour's phone, in findings later said to align with Google's investigation.
In October 2021, Google detected a campaign against an up-to-date Samsung phone that chained CVE-2021-38003 and CVE-2021-1048 to escape the sandbox, compromise the system, and inject code into privileged processes.
In September 2021, a second intrusion targeted a fully updated Samsung Galaxy S10 using CVE-2021-37973 and CVE-2021-37976 to escape the Chrome sandbox, followed by privilege escalation and backdoor deployment.
In August 2021, attackers used a phishing link and CVE-2021-38000 to pivot from Chrome to Samsung Internet on a Samsung Galaxy S21, beginning one of the Android exploitation campaigns tied to Cytrox's Predator spyware.
Google said the vulnerability later tracked as CVE-2021-1048 was fixed in the Linux kernel in September 2020, but the fix was not initially marked as a security issue and was not promptly backported to Android.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcethehackernews.com
Open sourceblog.google
Open sourcecitizenlab.ca
Open sourcechromereleases.googleblog.com
Open sourcechromium.googlesource.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google and Mandiant disclosed **PROMPTSPY**, an Android backdoor that uses AI-enabled functions to support credential theft, persistence, and operator resilience. The malware can capture biometric authentication input, display deceptive overlays to hinder removal, and relaunch remotely through Firebase Cloud Messaging. Investigators said operators can update command-and-control infrastructure, Gemini API keys, and VNC relay servers without redeploying the payload, allowing the malware to adapt after installation. Google said it disabled infrastructure tied to the activity, found no PROMPTSPY-infected apps on Google Play, and confirmed that Google Play Protect detects known samples. The report also described a broader rise in adversarial use of large language models and agentic tooling across the intrusion lifecycle. Google linked a suspected **PRC-nexus** actor to the use of tools including `Hexstrike`, `Graphiti`, `Strix`, `subfinder`, and `httpx` while targeting a Japanese technology company and an East Asian cybersecurity platform. Separately, the company said information operation actors tied to Russia, Iran, China, and Saudi Arabia are using AI for content generation, localization, reconnaissance, phishing preparation, environmental fingerprinting, and more autonomous attack workflows, including suspected AI voice cloning in the pro-Russia **Operation Overload** campaign.
Jun 29, 2026
Security researchers reported a sophisticated iPhone exploitation framework dubbed **Coruna** that appears to have originated as a professionally developed, likely government-grade capability and later proliferated to foreign espionage and criminal actors. Analyses cited by Google’s Threat Intelligence Group and mobile security firm iVerify describe **five exploit chains** spanning **20+ vulnerabilities** affecting **iOS 13 through 17.2.1**, enabling delivery via malicious web content for device fingerprinting, remote code execution, and bypass of key iOS mitigations; the tool’s apparent usage trail includes alleged deployment by **Russian intelligence against Ukrainian targets** and subsequent adoption by a cybercrime group for cryptocurrency theft. Separate mobile-threat reporting detailed multiple **Android** campaigns and families emphasizing stealth, persistence, and credential theft. CloudSEK described a **RedAlert** trojanized app impersonating Israel’s Home Front Command alerting application, using a **multi-stage APK/DEX loader chain** (including an `assets/` payload) and UI mimicry while coercing high-risk permissions (e.g., Contacts, SMS, Location) and establishing C2. PolySwarm summarized **PromptSpy**, an Android RAT with VNC-based remote control that integrates **Google Gemini** to generate context-aware UI gesture instructions from screen XML dumps to improve persistence across device variants, distributed via a phishing site impersonating a bank portal and assessed as financially motivated (notably targeting Argentina). Zimperium separately profiled **ZeroDayRAT** as a modular Android spyware platform spread via social engineering and sideloading, supporting surveillance and financial theft (e.g., screen capture, keylogging, credential harvesting), underscoring continued escalation in mobile malware sophistication.
Jun 29, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026