Loading story…
Researchers and journalists reported multiple cases in which Android spyware linked to government actors was distributed through official app stores, including Google Play. In one campaign, Lookout said North Korean operators deployed spyware it tracks as KoSpy through at least one Google Play app and additional listings on APKPure. The malware was built for surveillance, with capabilities to collect SMS messages, call logs, location data, files, keystrokes, Wi-Fi details, and installed apps, and to record audio, take photos, and capture screenshots. Lookout assessed the operation as highly targeted, likely aimed at specific individuals in South Korea, and linked supporting infrastructure to activity associated with APT37 and APT43.
A separate earlier case involved Exodus, spyware that researchers found hidden in Google Play apps and described as government malware. Together, the incidents show that official Android marketplaces have been used to deliver surveillance tools masquerading as legitimate apps. Google said it removed the identified KoSpy apps from Google Play, disabled related Firebase projects, and that Google Play Protect blocks known versions of the malware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Google said it removed the identified malicious apps from Google Play, deactivated the associated Firebase projects, and confirmed that Google Play Protect detects and blocks known versions of the spyware. This was the platform's response to the disclosed KoSpy campaign.
Researchers found at least one KoSpy-infected app on Google Play, where a cached page indicated more than 10 downloads, and additional malicious samples on APKPure. The apps supported Korean and English, reinforcing the assessment that the operation targeted South Korean users.
Lookout reported an Android spyware campaign it calls KoSpy and attributed it with high confidence to the North Korean government, linking infrastructure to activity associated with APT37 and APT43. The spyware was designed for surveillance and was assessed as highly targeted, likely aimed at specific individuals in South Korea.
Researchers found Android apps on the Google Play Store that were actually the Exodus surveillance malware, described as government spyware. The discovery showed that spyware had been distributed through the official Android app marketplace.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coalition of agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published advisories identifying the mobile spyware families **BadBazaar** and **Moonshine** in dozens of legitimate-looking apps. The malware was disguised as Android prayer apps, messaging tools, PDF readers, and utility apps, and one iOS app, **`TibetOne`**, was also named. Officials said the spyware targeted civil society groups and people connected to issues viewed by the Chinese state as sensitive, including Uyghur, Tibetan, Taiwanese, Hong Kong democracy, and Falun Gong communities. Technical analysis from the Australian Cyber Security Centre said **Moonshine** was distributed through trojanized apps, social media, messaging platforms, and in some cases official app stores, while **BadBazaar** included Android and iOS variants such as **BadSolar** and **BadSignal**. The spyware can collect files, chats, photos, location data, audio, and device information, giving operators broad surveillance access to cameras and microphones. Investigators also reported infrastructure overlaps tied to social-engineering assets, reused registration details, SSL certificate artifacts, and activity previously associated with **TA413**, **APT5**, **APT14**, and infrastructure linked to **UPSEC**.
Jun 29, 2026
Google and Mandiant disclosed **PROMPTSPY**, an Android backdoor that uses AI-enabled functions to support credential theft, persistence, and operator resilience. The malware can capture biometric authentication input, display deceptive overlays to hinder removal, and relaunch remotely through Firebase Cloud Messaging. Investigators said operators can update command-and-control infrastructure, Gemini API keys, and VNC relay servers without redeploying the payload, allowing the malware to adapt after installation. Google said it disabled infrastructure tied to the activity, found no PROMPTSPY-infected apps on Google Play, and confirmed that Google Play Protect detects known samples. The report also described a broader rise in adversarial use of large language models and agentic tooling across the intrusion lifecycle. Google linked a suspected **PRC-nexus** actor to the use of tools including `Hexstrike`, `Graphiti`, `Strix`, `subfinder`, and `httpx` while targeting a Japanese technology company and an East Asian cybersecurity platform. Separately, the company said information operation actors tied to Russia, Iran, China, and Saudi Arabia are using AI for content generation, localization, reconnaissance, phishing preparation, environmental fingerprinting, and more autonomous attack workflows, including suspected AI voice cloning in the pro-Russia **Operation Overload** campaign.
Jun 29, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026