Loading story…
ESET reported that an Android espionage operation dubbed eXotic Visit distributed trojanized but working mobile apps—primarily fake messaging services—to deliver the custom XploitSPY malware. The campaign was active from at least late 2021 through the end of 2023 and spread through dedicated websites, GitHub, alternative app stores, and Google Play. Researchers said the activity appears to have mainly targeted users in Pakistan and India, and they track the operators as Virtual Invaders without a confirmed link to any previously known threat group.
The malware gave operators broad surveillance and remote-control access, including theft of contacts, SMS messages, call logs, files, location data, notifications, audio recordings, and photos. ESET said later variants improved stealth with obfuscation, emulator detection, Firebase-based command-and-control retrieval, and native libraries used to conceal C2 details. The company identified about 380 compromised accounts across some of the malicious apps and reported multiple samples to Google, which removed the affected apps from Google Play.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
The Defcom app was uploaded to Google Play using a new C2 domain, zee.xylonn[.]com, and reached about six installs before removal.
ESET reported that the eXotic Visit espionage campaign continued operating through the end of 2023 as the malware evolved with added obfuscation, emulator detection, Firebase-based C2 retrieval, and native code.
The Sim Info app was uploaded to Google Play carrying the same malicious code as other campaign samples along with a native library to conceal sensitive data.
ESET found that version 1.3 of Dink Messenger, uploaded to Google Play, introduced the campaign's malicious code while retaining the same developer signing certificate as earlier benign versions.
The Dink Messenger app was first uploaded to Google Play without malicious functionality before later being weaponized.
MalwareHunterTeam publicly shared indicators related to the WeTalk lure, one of the earliest identified samples in the campaign.
ESET said the Android espionage campaign it calls eXotic Visit was active from at least November 2021, using trojanized but functional apps to target victims.
ESET identified ten additional Google Play apps containing XploitSPY-based code and reported multiple malicious apps to Google, which removed all identified malicious apps from Google Play.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026
SophosLabs reported a spyware campaign targeting Android users in Pakistan through Trojanized apps disguised as trusted local services, including **Pakistan Citizen Portal**, **Pakistan Salat Time**, **Mobile Packages Pakistan**, **Registered SIMs Checker**, **TPL Insurance**, and a fake **Pakistan Chat** app. Once installed, the apps profiled devices and stole contacts, SMS messages, call logs, location data, storage listings, and photos; some variants also harvested credentials and national identity information. The malware used spoofed domains including `pmdu.info`, `pakchat.online`, `tplinsurance.xyz`, and `kv33.zapto.org`, with command-and-control infrastructure hosted in the Netherlands, Latvia, Bulgaria, and the United States. Sophos said the spyware relied on app mimicry, disguised package names, AES-encrypted strings, XOR-encoded data theft, and delayed delivery of core spying functions through downloaded DEX payloads, indicating an actively developed surveillance operation tracked as **Andr/Spy-BDD**.
Aug 14, 2026
Lookout reported multiple mobile surveillance campaigns targeting officials, diplomats, military personnel, activists, and other high-value individuals across South Asia and the Middle East. In one campaign, the **Confucius APT** was linked with high confidence to the Android spyware families **Hornbill** and **SunBird**, which targeted people connected to Pakistan’s military and nuclear organizations as well as election officials in Kashmir. The malware could exfiltrate messages, geolocation, media, call records, documents, and **WhatsApp** content, while insecure command-and-control servers exposed more than **18 GB** of stolen data tied to victims in India, Pakistan, Kazakhstan, Europe, the United States, and the UAE. Lookout also detailed the earlier **Stealth Mango** and **Tangelo** surveillance operation, attributed to members of the Pakistani military, which targeted Android and iOS devices used by government officials, diplomats, military personnel, and activists in Pakistan, Afghanistan, India, Iraq, and the UAE. That campaign relied mainly on phishing through fake Facebook personas and, in some cases, physical access rather than exploits, and collected government communications, travel details, identity documents, GPS data, legal and medical records, and photos from sensitive meetings. Lookout said Google updated **Google Play Protect** and removed malicious Android apps from affected devices, while the research also tied the operators to freelance developers associated with other commercial or commodity spyware tools.
Aug 15, 2026