Mobile and Web Fraud Campaigns Impersonating Public Services to Steal Data

Multiple active fraud and malware operations are abusing trusted themes and brands to compromise users, with a heavy emphasis on mobile-first delivery via social engineering. Zimperium reported a targeted Android spyware operation delivered through a fake “dating” app promoted via social media and messaging links; once installed, the app requests broad permissions (e.g., SMS, contacts, media) to enable surveillance and data exfiltration including messages, location, and credentials. Separately, Zimperium also described an Android campaign that hides a RAT inside artifacts presented as legitimate AI/ML components hosted on trusted framework infrastructure, enabling attackers to bypass basic screening and gain persistent device control (data theft, screen capture, remote command execution).

In parallel, CybersecurityNews summarized two public-service impersonation campaigns tied to “traffic ticket” lures. In India, attackers are mimicking RTO e-challan notifications distributed via WhatsApp and other messaging platforms to push off-store Android apps that steal financial and personal data; the malware reportedly uses a three-stage modular architecture, dynamic remote configuration, anti-analysis, and a custom VPN tunnel to conceal C2 and exfiltration, while prompting victims for high-risk permissions and to disable battery optimization for persistence. In Canada, a separate operation uses SEO poisoning and SMS/ad lures to drive victims to fake provincial traffic ticket payment portals (e.g., BC, Ontario, Quebec) that harvest PII and payment card data; Unit 42 attributed the activity to a broader fraud network using a phishing kit with a “waiting room” feature and infrastructure spanning 70+ domains, including concentration on the 45.156.87.0/24 netblock.