Loading story…
A coalition of agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published advisories identifying the mobile spyware families BadBazaar and Moonshine in dozens of legitimate-looking apps. The malware was disguised as Android prayer apps, messaging tools, PDF readers, and utility apps, and one iOS app, TibetOne, was also named. Officials said the spyware targeted civil society groups and people connected to issues viewed by the Chinese state as sensitive, including Uyghur, Tibetan, Taiwanese, Hong Kong democracy, and Falun Gong communities.
Technical analysis from the Australian Cyber Security Centre said Moonshine was distributed through trojanized apps, social media, messaging platforms, and in some cases official app stores, while BadBazaar included Android and iOS variants such as BadSolar and BadSignal. The spyware can collect files, chats, photos, location data, audio, and device information, giving operators broad surveillance access to cameras and microphones. Investigators also reported infrastructure overlaps tied to social-engineering assets, reused registration details, SSL certificate artifacts, and activity previously associated with TA413, APT5, APT14, and infrastructure linked to UPSEC.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2025-04-09, the Australian Cyber Security Centre released technical analysis describing Moonshine and BadBazaar surveillance functions, including access to files, location, audio, photos, chats, cameras, microphones, and device information. The analysis also documented infrastructure overlaps and artifacts linking activity to clusters previously associated with UPSEC, TA413, and characteristics seen in earlier APT5 and APT14 investigations.
On 2025-04-09, government agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published coordinated advisories on the BadBazaar and Moonshine mobile spyware families. The advisories said the spyware was embedded in legitimate-looking Android apps, and in at least one identified iOS app, to surveil people linked to issues viewed by the Chinese state as sensitive.
Before the government advisories, the BadBazaar and Moonshine spyware families had already been documented by security researchers including Lookout, Trend Micro, Volexity, and Citizen Lab. Their reporting established that the malware was distributed through trojanized mobile apps targeting Tibetan, Uyghur, Taiwanese, and related communities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and journalists reported multiple cases in which Android spyware linked to government actors was distributed through official app stores, including **Google Play**. In one campaign, Lookout said North Korean operators deployed spyware it tracks as **KoSpy** through at least one Google Play app and additional listings on APKPure. The malware was built for surveillance, with capabilities to collect **SMS messages, call logs, location data, files, keystrokes, Wi-Fi details, and installed apps**, and to **record audio, take photos, and capture screenshots**. Lookout assessed the operation as highly targeted, likely aimed at specific individuals in South Korea, and linked supporting infrastructure to activity associated with **APT37** and **APT43**. A separate earlier case involved **Exodus**, spyware that researchers found hidden in Google Play apps and described as government malware. Together, the incidents show that official Android marketplaces have been used to deliver surveillance tools masquerading as legitimate apps. Google said it removed the identified KoSpy apps from Google Play, disabled related Firebase projects, and that **Google Play Protect** blocks known versions of the malware.
Jun 29, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026