New Spyware Campaigns Target Privacy-Conscious Android Users in the UAE
ESET researchers have uncovered two new Android spyware campaigns, dubbed ProSpy and ToSpy, specifically targeting users in the United Arab Emirates who utilize secure communication apps like Signal and ToTok. The malware is distributed through deceptive websites and social engineering tactics, often impersonating legitimate app updates or plugins such as 'Signal Encryption Plugin' and 'ToTok Pro.' These malicious applications are not available on official app stores, requiring victims to manually install them from third-party sources, including a fake site mimicking the Samsung Galaxy Store. Once installed, the spyware maintains persistence on the device and exfiltrates sensitive data, including documents, media, contacts, and chat backups, with ToSpy specifically targeting ToTok backup files. The campaign appears regionally focused, leveraging domain names associated with the UAE. ESET has shared these findings with Google, and Android devices with Google Play Protect are automatically protected against known versions of this spyware. The discovery highlights ongoing threats to digital privacy in the region, exploiting users' desire for secure communication by weaponizing the very tools they trust.
Wire timeline
New Spyware Campaigns Target Privacy-Conscious Android Users in the UAE
ESET researchers have uncovered two new Android spyware campaigns, dubbed ProSpy and ToSpy, specifically targeting users in the United Arab Emirates who utilize secure communication apps like Signal and ToTok. The malware is distributed through deceptive websites and social engineering tactics, often impersonating legitimate app updates or plugins such as 'Signal Encryption Plugin' and 'ToTok Pro.' These malicious applications are not available on official app stores, requiring victims to manually install them from third-party sources, including a fake site mimicking the Samsung Galaxy Store. Once installed, the spyware maintains persistence on the device and exfiltrates sensitive data, including documents, media, contacts, and chat backups, with ToSpy specifically targeting ToTok backup files. The campaign appears regionally focused, leveraging domain names associated with the UAE. ESET has shared these findings with Google, and Android devices with Google Play Protect are automatically protected against known versions of this spyware. The discovery highlights ongoing threats to digital privacy in the region, exploiting users' desire for secure communication by weaponizing the very tools they trust.
WeLiveSecurity