Loading story…
ESET reported that Radio Balouch (also distributed as RB Music) became the first known spyware built on the open-source AhMyth Android malware framework to pass Google Play vetting and appear in the official app store. The app posed as a legitimate Balouchi music streaming service while covertly harvesting contacts, stealing files, and gaining the ability to send SMS messages. Researchers said the malicious app was listed on Google Play twice before being removed after notification to Google.
The spyware also spread through third-party app stores, a dedicated website, Instagram, and YouTube, broadening its reach beyond the official marketplace. ESET found that the malware communicated with radiobalouch[.]com for command-and-control and data exfiltration, and that both stolen information and submitted credentials were sent over unencrypted HTTP, increasing exposure risk. The case underscored gaps in Google Play screening and raised concerns that additional AhMyth-based clones could surface in both official and unofficial Android distribution channels.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Radio Balouch returned to Google Play on July 13, 2019, marking a second appearance in the official store. ESET identified it again as spyware built on the AhMyth framework.
ESET reported the first Google Play appearance of the malicious Radio Balouch app to Google's security team on July 2, 2019. The app masqueraded as a Balouchi music streaming application while containing AhMyth-based spyware.
The domain radiobalouch[.]com, used to distribute the app and support command-and-control communications, was registered on March 30, 2019.
The AhMyth remote access tool framework was publicly released as open source in late 2017. Radio Balouch was later built on this framework.
ESET stated that its mobile security solution had protected users from AhMyth and related malware families since January 2017. This indicates the company had visibility into AhMyth-based threats before the Radio Balouch case.
The dedicated Radio Balouch website went offline shortly after ESET filed a complaint and remained down at the time of reporting. The site had been used to promote and distribute the app outside Google Play.
Google swiftly removed the second Radio Balouch listing after ESET reported it. This second listing also had more than 100 installs.
Google removed the first Radio Balouch listing from Google Play within 24 hours after ESET's report. The listing had accumulated more than 100 installs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple Android-focused campaigns that rely on **sideloaded apps** from fraudulent websites, social media, and messaging channels rather than exploits in official app stores. ESET identified a previously undocumented spyware family, **Asin**, distributed since early 2025 through fake sites impersonating a government news outlet, a PDF tool, and a conflict-mapping service. The apps offered decoy functionality while covertly collecting data in the background, and victims had to manually install APKs and approve permissions; samples were linked to domains including `c-pdf[.]net` and `syriadefensemap[.]com`, with activity still observed into 2026 on Xiaomi Redmi Note 13 Pro-series devices running Android 15. A separate mobile threat trend used unofficial IPTV and football streaming apps to target users seeking pirated broadcasts in Spain and Italy, especially around major matches such as the UEFA Champions League final. ThreatFabric said apps masquerading as services like RojaDirecta were used to deliver banking malware including **Massiv** and **Perseus**, sometimes hidden inside functional apps with tools such as **Zombinder**. Once installed, the malware could abuse **Accessibility Services** for credential theft, MFA bypass, remote control, and full device takeover, underscoring how attackers are exploiting user demand for news, utilities, war tracking, and free sports streams to compromise Android devices.
Jun 29, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026
Researchers said China-aligned espionage group **GREF** distributed trojanized Android messaging apps, **Signal Plus Messenger** and **FlyGram**, through **Google Play**, the **Samsung Galaxy Store**, dedicated websites, and in FlyGram’s case a Uyghur-focused Telegram channel. The apps carried the **BadBazaar** spyware family and were tied to targeting patterns previously associated with **Uyghurs and other Turkic minorities**. Google removed the malicious apps after notification, but ESET reported they were still present in Samsung’s store at the time of publication. **Signal Plus Messenger** abused Signal’s legitimate linked-device feature in what researchers described as the first documented case of covert Signal account spying through secret device linking, allowing attackers to intercept messages without alerting victims. **FlyGram** impersonated Telegram and stole device and Telegram-related data, while a malicious **Cloud Sync** feature uploaded backups and metadata to attacker-controlled servers; ESET observed at least **13,953 accounts** enabling that feature. Researchers said the fake Signal app saw fewer than **500 downloads** on Google Play, suggesting a more targeted operation than broad consumer malware distribution.
Aug 15, 2026