Loading story…
Lookout disclosed multiyear Android surveillance campaigns tied to China-origin activity that targeted the Uyghur ethnic minority and, to a lesser extent, Tibetans, using spyware families including SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle. The operations dated back to at least 2013 and relied on trojanized versions of legitimate apps that continued to function normally while covertly stealing contacts, messages, call records, device details, and location-related data for exfiltration to attacker-controlled infrastructure. Lookout linked the mobile activity to a broader surveillance toolkit that also included HenBox, PluginPhantom, Spywaller, and DarthPusher, and assessed that victims may have been affected across at least 14 countries, including Turkey, Kuwait, and Syria.
Citizen Lab documented an earlier, highly targeted Android malware campaign against prominent Tibetans that used forged emails and trojanized Kakao Talk and TuneIn Radio APKs to compromise devices. The malware preserved normal app behavior but added hidden spying functions, including periodic beaconing to android.uyghur.dnsd.me, encrypted configuration retrieval, data uploads, and the ability to respond silently to SMS commands with cellular network and base-station identifiers. The findings from both organizations show a long-running pattern of mobile espionage delivered through phishing and fake third-party app stores rather than Google Play, with overlaps in Uyghur-themed infrastructure and lures pointing to sustained surveillance of dissident communities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Lookout observed a dramatic increase in surveillanceware samples after Chinese national security and counterterrorism measures, including the Strike Hard Campaign against Violent Terrorism, were enacted in 2014 and 2015. The increase marked an escalation in the broader mobile surveillance activity targeting Uyghurs.
On April 18, 2013, Citizen Lab updated its report to note that a trojanized TuneIn Radio APK had circulated alongside the Kakao Talk sample in the same January 16 spoofed email. The TuneIn malware used the same fake signing certificate and was described as functionally identical.
Citizen Lab analyzed and disclosed a highly targeted Android malware operation against prominent members of the Tibetan community involving a trojanized Kakao Talk APK delivered by forged email. The report documented the malware's surveillance capabilities, C2 infrastructure, and overlap with Uyghur-themed infrastructure.
Citizen Lab reported that Avast, Lookout, and Kaspersky mobile scanners did not detect the compromised Kakao Talk app during tests conducted on February 6, 2013 and March 27, 2013. The finding suggested manual review of Android permissions was necessary to identify the threat at the time.
On January 16, 2013, a forged email impersonating the same security expert was sent to a high-profile Tibetan political figure with a compromised Kakao Talk APK attached. The malware preserved normal chat functionality while adding spyware features and communicated with the C2 domain android.uyghur.dnsd.me.
Lookout reported that interconnected Android surveillance campaigns using SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle date back to at least 2013. The China-origin activity primarily targeted Uyghurs and, to a lesser extent, Tibetans through trojanized apps and other delivery methods.
On December 4, 2012, a Tibetan community information security expert sent a legitimate private email to a member of the Tibetan parliament-in-exile in Dharamsala, India, attaching genuine Kakao Talk and TuneIn APK files. Citizen Lab later assessed attackers likely accessed this message via a compromised email account and reused it in a targeting operation.
Lookout reported four Android surveillanceware families—SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle—as part of broader China-origin mobile APT campaigns targeting Uyghurs and some Tibetans. The company also linked the mobile activity to GREF/APT15-related desktop activity and assessed that at least 14 countries may have been affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
blog.lookout.com
Open sourcecitizenlab.ca
Open sourcelookout.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK National Cyber Security Centre and international government partners warned that the **BADBAZAAR** and **MOONSHINE** spyware families are being used to target mobile users linked to **Uyghur, Tibetan, Taiwanese, Hong Kong, Xinjiang, democracy, and Falun Gong** issues. The malware is delivered through trojanized Android and iOS apps that masquerade as legitimate software, sometimes impersonating brands such as **WhatsApp** and **Skype**, and has been spread via social media, messaging platforms, third-party download sites, and in some cases official app stores. Agencies said the targeting aligns with subjects the Chinese state views as threatening to its stability, and assessed that the stolen data would almost certainly be valuable to Beijing. The spyware can covertly collect messages, files, photos, device information, and location data, while also enabling access to microphones and cameras for real-time surveillance. The advisory cited examples including the **MOONSHINE** sample `ئاۋازلىق قۇرئان.apk` aimed at Uyghur users and the **BADBAZAAR**-linked **TibetOne** iOS app, supported by infrastructure such as `tibetone[.]org` and promoted through Telegram and Reddit. Officials urged at-risk users to install apps only from trusted sources, keep devices updated, avoid rooted or jailbroken phones, review app permissions regularly, and report suspicious links, accounts, and messages; a companion technical advisory also called on app store operators, developers, and social media companies to help detect and disrupt the campaign.
Aug 15, 2026
Lookout reported multiple mobile surveillance campaigns targeting officials, diplomats, military personnel, activists, and other high-value individuals across South Asia and the Middle East. In one campaign, the **Confucius APT** was linked with high confidence to the Android spyware families **Hornbill** and **SunBird**, which targeted people connected to Pakistan’s military and nuclear organizations as well as election officials in Kashmir. The malware could exfiltrate messages, geolocation, media, call records, documents, and **WhatsApp** content, while insecure command-and-control servers exposed more than **18 GB** of stolen data tied to victims in India, Pakistan, Kazakhstan, Europe, the United States, and the UAE. Lookout also detailed the earlier **Stealth Mango** and **Tangelo** surveillance operation, attributed to members of the Pakistani military, which targeted Android and iOS devices used by government officials, diplomats, military personnel, and activists in Pakistan, Afghanistan, India, Iraq, and the UAE. That campaign relied mainly on phishing through fake Facebook personas and, in some cases, physical access rather than exploits, and collected government communications, travel details, identity documents, GPS data, legal and medical records, and photos from sensitive meetings. Lookout said Google updated **Google Play Protect** and removed malicious Android apps from affected devices, while the research also tied the operators to freelance developers associated with other commercial or commodity spyware tools.
Aug 15, 2026
Researchers reported that the **Scarlet Mimic** threat group conducted a years-long mobile surveillance operation targeting the Uyghur community and associated activists, with activity traced from 2015 through at least mid-2022. The campaign used Android malware known as **MobileOrder**, delivered outside Google Play through social-engineering lures disguised as Uyghur-themed PDFs, images, and audio files, continuing a broader espionage pattern previously linked to Scarlet Mimic’s targeting of minority activists. Once installed, the spyware enabled extensive device monitoring and control, including data theft, location tracking, call and SMS abuse, call recording, ambient audio capture, screenshot collection, remote shell access, and installation of additional APKs. Researchers said the malware evolved over time with updated string obfuscation, dead-drop resolvers hosted on Sina blogs, **AES**-encrypted command-and-control traffic, and a move from the **AMAP SDK** to Android `LocationListener` for real-time tracking, reinforcing the assessment that Scarlet Mimic maintained a sustained and adaptive surveillance campaign against Uyghurs.
Aug 14, 2026