Loading story…
The Bahamut threat group ran Android espionage campaigns that used phishing websites to trick victims into installing malicious APKs disguised as religious community apps, secure messaging tools, and other themed applications. Researchers linked the activity to domains including jamaat-ul-islam[.]com, jamatapplication[.]com, jamaatforummah[.]com, jamaatforallah[.]com, and securechatnow.com, with targeting focused on users in the Middle East and South Asia. The lures impersonated trusted services and communities to deliver spyware under names such as "Chat Services" and counterfeit Jamaat chat apps.
Once installed, the malware sought extensive Android permissions and abused Accessibility Service to conduct broad surveillance on infected devices. It collected contacts, SMS messages, call logs, files, location data, audio, device identifiers, and notification content, and newer variants expanded collection to messaging platforms including WhatsApp, Signal, Telegram, Viber, Imo, Facebook Messenger, ProtectedText, and Tor-related chat apps. Stolen data was stored locally and exfiltrated to command-and-control infrastructure over HTTPS using Socket.IO, with uploads triggered by device events and on a recurring four-hour schedule.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Cyble Research Labs reported that a new variant of Bahamut Android spyware was observed in the wild in April 2022 after about a year of reduced visibility. The malware was distributed via phishing sites impersonating secure messaging download portals and an obscene-themed site.
Cyble reported that Bahamut-linked operators ran a phishing campaign distributing malicious Android APKs through counterfeit Jamaat-themed websites, with apps masquerading as Jamaat chat and Muslim youth applications. The spyware harvested extensive device and user data and exfiltrated it to command-and-control infrastructure.
Cyble states that the Bahamut advanced persistent threat group was first discovered in 2017. The group is described as targeting the Middle East and South Asia through phishing and malware campaigns.
Cyble said the 2022 Bahamut Android spyware variant introduced modules to harvest data from messaging applications including Viber, Telegram, Signal, WhatsApp, Imo, Facebook Messenger, ProtectedText, and a Tor-related chat app. The malware abused Android Accessibility Service and dangerous permissions to capture screen text and other sensitive data for exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.cyble.com
Open sourceblog.cyble.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Bahamut** cybermercenary group ran a targeted Android espionage campaign that distributed spyware through a fake **SecureVPN** website, using trojanized versions of legitimate VPN applications to infect victims. Researchers said the operation had been active since at least January 2022 and initially repackaged **SoftVPN** before later shifting to **OpenVPN**, embedding Bahamut spyware while gating execution with an activation-key mechanism that likely restricted infections to selected targets. The malware was built for covert surveillance and data theft, with capabilities to collect contacts, SMS messages, call logs, location data, device details, installed-app lists, and files, as well as record phone calls. It also abused Android accessibility services to monitor messaging apps and enable keylogging. Investigators identified at least eight malware variants and linked the fake VPN infrastructure to earlier Bahamut activity through code overlap and operational similarities with prior **SecureChat** campaigns, reinforcing the assessment that the operation was low-volume, highly targeted, and designed for espionage rather than mass distribution.
Aug 14, 2026
Researchers reported an Android malware campaign using a trojanized **BH Alert** application that impersonates Bahrain’s official civil defense emergency app to infect users and establish long-term device control. The malware, tracked as **Octagon**, uses a multi-stage infection chain with dynamically loaded encrypted `DEX` and `JAR` payloads, installs a secondary child APK, and abuses Android **VPN** and **Accessibility** services to expand surveillance and credential theft. Analysts said the malware can intercept device traffic, capture lock-screen credentials, and store stolen data locally while preserving command-and-control configuration and operational state in `SharedPreferences`. The campaign was also linked to infrastructure and artifacts associated with the fake **BH-Alert** APK, including package identifiers, file hashes, BH-Alert-themed distribution URLs, and a command-and-control endpoint at `209.99.184.50:4444`. Octagon was described as a modular and persistent Android threat that survives reboots through mechanisms including **AccountManager**, **Sync Adapter** abuse, watchdog-style services, and boot receivers, enabling resilient access to compromised devices and sustained monitoring of victims in Bahrain.
Aug 3, 2026
A malicious Android app masquerading as Bahrain Civil Defense's **"BH Alert"** emergency application is being distributed through fake Google Play pages and spoofed Bahraini government websites, with researchers saying the campaign is designed to exploit public anxiety during regional missile strikes and civil-defense alerts. Victims are reportedly lured via smishing, social media, and messaging links to sideload a rogue APK outside official app stores, where demand for emergency-alert apps has surged across Bahrain, Kuwait, and other Gulf states. Researchers at Dream Research Lab said the app uses a four-stage infection chain that deploys **OctagonPanel** malware and the **Ward** framework, giving attackers broad surveillance and remote-access capabilities. The malware can steal lock-screen PINs, one-time passwords, SMS messages, banking credentials, contacts, call logs, and screenshots, while also using banking overlays, Accessibility Services abuse, watchdog processes, boot receivers, runtime code injection, and RC4-encrypted payloads hidden in font files to maintain persistence and evade detection. Analysts warned that infected employee phones could help attackers bypass MFA and reach corporate applications, and recommended MDM controls to block sideloading, restrict app execution, and monitor for the malware's roughly five-second command-and-control heartbeat.
Jul 23, 2026