ToSpy
ToSpy is an Android spyware family, detected by ESET as Android/Spy.ToSpy, that impersonates the ToTok messaging application and has been used in a long-running campaign primarily targeting users in the United Arab Emirates. The malware is distributed via deceptive third-party websites rather than official app stores, including fake ToTok download pages and at least one site mimicking the Samsung Galaxy Store. Available reporting indicates the campaign was first detected in June 2025, but samples, certificate metadata, domain registrations, and VirusTotal uploads trace activity back to mid-2022, and parts of the infrastructure remained active at the time of reporting.
Once installed, ToSpy requests access to contacts and device storage, establishes persistence using a foreground service, AlarmManager restarts, and a BOOT_COMPLETED receiver, and then waits for command-and-control instructions before exfiltrating data. Reported collection includes contacts, basic device information, and files such as documents, spreadsheets, presentations, text files, audio, images, videos, CSV/VCF data, and ToTok backup files with the .ttkmbackup extension, indicating interest in ToTok chat history or app data. Some reporting also states it can steal chats, files, media, SMS messages, contacts, and app backups in broader campaign context. ToSpy checks for updates via spiralkey[.]co/totok_update/totokversion.php and may download an APK from spiralkey[.]co/totok_update/totok_pro.apk. Exfiltrated data is reported as encrypted with AES-CBC using the hardcoded key p2j8w9savbny75xg and sent via HTTPS POST requests.
The malware uses social engineering to appear legitimate: if the real ToTok app is present, it may show fake update screens and launch the legitimate app; if not present, it may redirect the user to Huawei AppGallery, a browser page, or the official ToTok download source. ESET reported six samples sharing the same malicious codebase and developer certificate DE90F6899EEC315F4ED05C2AA052D4FE8B71125A. Active or referenced infrastructure includes store.appupdate[.]ai and spiralkey[.]co. ToSpy is frequently discussed alongside the related Android spyware family ProSpy, but ESET tracks them separately due to different infrastructure and delivery methods. Attribution to a specific threat actor is not established in the source content, although some broader reporting links the surrounding espionage campaign involving ProSpy and ToSpy to BITTER; this linkage is not conclusively established for ToSpy alone.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
The spyware is installed through fake websites and app stores... The apps containing the spyware can only be installed manually via third-party websites, according to ESET researcher Lukáš Štefanko.
Neither app appears in official app stores; victims have to manually install APK files from cloned websites or third-party pages designed to look like legitimate services.
Execution
3 techniques
Execution
Both spyware families use three persistence mechanisms on infected devices: Abuse of the ‘AlarmManager’ Android system API to restart automatically if killed.
Persistence
3 techniques
Persistence
Both spyware families use three persistence mechanisms on infected devices: Abuse of the ‘AlarmManager’ Android system API to restart automatically if killed.
Registers to receive BOOT_COMPLETED broadcast events so it can restart the spyware upon device reboot without user interaction.
To achieve persistence, both the spyware families run a foreground service that displays a persistent notification, use Android's AlarmManager to repeatedly restart the foreground service if it gets terminated, and automatically launch the necessary background services upon a device reboot.
Privilege Escalation
3 techniques
Privilege Escalation
Both spyware families use three persistence mechanisms on infected devices: Abuse of the ‘AlarmManager’ Android system API to restart automatically if killed.
Registers to receive BOOT_COMPLETED broadcast events so it can restart the spyware upon device reboot without user interaction.
To achieve persistence, both the spyware families run a foreground service that displays a persistent notification, use Android's AlarmManager to repeatedly restart the foreground service if it gets terminated, and automatically launch the necessary background services upon a device reboot.
Stealth
1 technique
Stealth
Discovery
3 techniques
Discovery
Collection
2 techniques
Collection
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android spyware delivered through social engineering and malicious links or chat-based lures. It is described as capable of monitoring user activity and stealing photos, audio, videos, SMS messages, contact lists, private files, and app backup files.
Spyware deployed through deceptive websites impersonating messaging applications to target victims in the U.A.E.
ToSpy is Android spyware that impersonates legitimate apps to exfiltrate chat data, recordings, and files from compromised devices.
Android spyware that impersonates legitimate apps to gain persistent access and steal data from targeted devices.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.