Loading story…
Researchers linked Earth Empusa—also tracked as POISON CARP and Evil Eye—to a sustained mobile espionage campaign targeting people connected to Uyghur, Tibetan, Turkish, and Taiwanese communities. The group used phishing messages, fake download pages, and compromised websites to deliver malware and profile victims, including an Android spyware family dubbed ActionSpy that impersonated the legitimate Uyghur video app Ekran. Trend Micro said the malware harvested device details, location, files, audio, screenshots, and camera images, and abused Android Accessibility services to steal chat content from apps including WeChat, QQ, WhatsApp, and Viber.
The same activity overlapped with earlier reporting on large-scale surveillance of Uyghurs and with in-the-wild iOS watering-hole attacks documented by Google Project Zero and Google TAG. In that campaign, visitors to hacked websites were hit with multiple exploit chains spanning nearly all supported iOS 10–12 versions, enabling installation of implants that stole iMessages, photos, and GPS data in real time. Google identified 14 vulnerabilities across the chains, including browser, kernel, and sandbox-escape flaws, and Apple issued iOS 12.1.4 after being notified, underscoring the breadth of a multi-year operation aimed at monitoring targeted communities across both Android and iPhone devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published research identifying the undocumented Android spyware family ActionSpy and linking its phishing and watering hole delivery to Earth Empusa.
Trend Micro found another phishing page in late April 2020 that had been copied from a third-party web store and injected with ScanBox and BeEF.
In April 2020, researchers found a phishing page disguised as a download page for a popular Tibetan Android video application that delivered the ActionSpy spyware.
Researchers found the same malicious injection on a university website and a travel agency site based in Taiwan.
Trend Micro found that Earth Empusa hosted copied pages from Uyghur-related news sites on its server and injected scripts that loaded the BeEF framework.
Later in 2020 after its first-quarter activity in Tibet and Turkey, Earth Empusa expanded its targeting to Taiwan.
Trend Micro observed Earth Empusa's malicious website injections on multiple Uyghur-related sites since the start of 2020, alongside compromises of Turkish sites using the same attack.
During the first quarter of 2020, the group's iOS exploit chain was updated to target iOS 12.3, 12.3.1, and 12.3.2.
In the first quarter of 2020, Earth Empusa targeted users in Tibet and Turkey as part of its mobile espionage operations.
Google publicly disclosed the complete details it had shared with Apple about the five exploit chains and the implant used in the campaign.
Apple released iOS 12.1.4 out of band in response to the reported iPhone exploit vulnerabilities affecting the watering hole campaign.
Google reported fourteen vulnerabilities from five in-the-wild iPhone exploit chains to Apple and imposed a 7-day disclosure deadline.
Google Project Zero said the hacked websites delivering iPhone exploit chains reflected a sustained watering hole operation targeting certain communities for at least two years.
Trend Micro assessed that the Android spyware family ActionSpy had existed since at least 2017, citing a certificate signing time of 2017-07-10 and older samples created that year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourcegoogleprojectzero.blogspot.com
Open sourcevolexity.com
Open sourcevolexity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lookout disclosed multiyear Android surveillance campaigns tied to China-origin activity that targeted the Uyghur ethnic minority and, to a lesser extent, Tibetans, using spyware families including **SilkBean**, **DoubleAgent**, **CarbonSteal**, and **GoldenEagle**. The operations dated back to at least 2013 and relied on trojanized versions of legitimate apps that continued to function normally while covertly stealing contacts, messages, call records, device details, and location-related data for exfiltration to attacker-controlled infrastructure. Lookout linked the mobile activity to a broader surveillance toolkit that also included **HenBox**, **PluginPhantom**, **Spywaller**, and **DarthPusher**, and assessed that victims may have been affected across at least 14 countries, including Turkey, Kuwait, and Syria. Citizen Lab documented an earlier, highly targeted Android malware campaign against prominent Tibetans that used forged emails and trojanized **Kakao Talk** and **TuneIn Radio** APKs to compromise devices. The malware preserved normal app behavior but added hidden spying functions, including periodic beaconing to `android.uyghur.dnsd.me`, encrypted configuration retrieval, data uploads, and the ability to respond silently to SMS commands with cellular network and base-station identifiers. The findings from both organizations show a long-running pattern of mobile espionage delivered through phishing and fake third-party app stores rather than Google Play, with overlaps in Uyghur-themed infrastructure and lures pointing to sustained surveillance of dissident communities.
Aug 15, 2026
Researchers reported that the **Scarlet Mimic** threat group conducted a years-long mobile surveillance operation targeting the Uyghur community and associated activists, with activity traced from 2015 through at least mid-2022. The campaign used Android malware known as **MobileOrder**, delivered outside Google Play through social-engineering lures disguised as Uyghur-themed PDFs, images, and audio files, continuing a broader espionage pattern previously linked to Scarlet Mimic’s targeting of minority activists. Once installed, the spyware enabled extensive device monitoring and control, including data theft, location tracking, call and SMS abuse, call recording, ambient audio capture, screenshot collection, remote shell access, and installation of additional APKs. Researchers said the malware evolved over time with updated string obfuscation, dead-drop resolvers hosted on Sina blogs, **AES**-encrypted command-and-control traffic, and a move from the **AMAP SDK** to Android `LocationListener` for real-time tracking, reinforcing the assessment that Scarlet Mimic maintained a sustained and adaptive surveillance campaign against Uyghurs.
Aug 14, 2026
Security researchers reported a sophisticated iPhone exploitation framework dubbed **Coruna** that appears to have originated as a professionally developed, likely government-grade capability and later proliferated to foreign espionage and criminal actors. Analyses cited by Google’s Threat Intelligence Group and mobile security firm iVerify describe **five exploit chains** spanning **20+ vulnerabilities** affecting **iOS 13 through 17.2.1**, enabling delivery via malicious web content for device fingerprinting, remote code execution, and bypass of key iOS mitigations; the tool’s apparent usage trail includes alleged deployment by **Russian intelligence against Ukrainian targets** and subsequent adoption by a cybercrime group for cryptocurrency theft. Separate mobile-threat reporting detailed multiple **Android** campaigns and families emphasizing stealth, persistence, and credential theft. CloudSEK described a **RedAlert** trojanized app impersonating Israel’s Home Front Command alerting application, using a **multi-stage APK/DEX loader chain** (including an `assets/` payload) and UI mimicry while coercing high-risk permissions (e.g., Contacts, SMS, Location) and establishing C2. PolySwarm summarized **PromptSpy**, an Android RAT with VNC-based remote control that integrates **Google Gemini** to generate context-aware UI gesture instructions from screen XML dumps to improve persistence across device variants, distributed via a phishing site impersonating a bank portal and assessed as financially motivated (notably targeting Argentina). Zimperium separately profiled **ZeroDayRAT** as a modular Android spyware platform spread via social engineering and sideloading, supporting surveillance and financial theft (e.g., screen capture, keylogging, credential harvesting), underscoring continued escalation in mobile malware sophistication.
Jun 29, 2026