potential targets of the activity tracked read more about Samsung Mobile Flaw Exploited as Zero-Day to Deploy LANDFALL Android Spyware

A now-patched security flaw in Samsung Galaxy Android devices was exploited as a zero-day to deliver a "commercial-grade" Android spyware dubbed LANDFALL in targeted attacks in the Middle East. The activity involved the exploitation of CVE-2025-21042 (CVSS score: 8.8), an out-of-bounds write flaw in the "libimagecodec.quram.so" component that could allow remote attackers to execute arbitrary

uses phony websites posing as Signal read more about Beware of Android Spyware Disguised as Signal Encryption Plugin and ToTok Pro

 Doctor Web researchers discovered a new spyware, tracked as Android. Spy.1292.origin, targets Russian military people. The malicious code was concealed in a trojanized Alpine Quest app and distributed via Russian Android catalogues. The malware acquires contacts, geolocation, and file data, and it can also download additional modules to exfiltrate stored data when directed.  “Alpine Quest is topographic software that allows different maps to be used both in online and offline mode. It is popular among athletes, travelers, and hunters but also widely used by Russian military personnel in the Special Military Operation zone—and this is what the malware campaign organizers decided to exploit.” reads the report published by researchers at Doctor Web. Threat actors embedded Android.Spy.1292.origin into one of the older Alpine Quest app versions and distributed the trojanized variant under the guise of a freely available version of Alpine Quest Pro, a program with advanced functionality.”  To propagate the trojanized Alpine Quest software, threat actors developed a fraudulent Telegram channel. They shared an app download link from a Russian app store, and then they used the same route to push a malicious update. To evade detection, Android.Spy.1292.origin is embedded within a real copy of the Alpine Quest app, causing it to seem and behave just like the original.  When the app is activated, the trojan discreetly collects and sends information to a command-and-control server, including the user's phone number, accounts, contact list, current date, geolocation, stored file details, and app version. Simultaneously, it transmits some of this information, such as updated geolocation, with the attackers' Telegram bot whenever the device's position changes.  Once the trojan has gathered file information, attackers can command it to download and execute other modules to steal specific data. The attackers behind the malicious app appear to be interested in confidential information transmitted via Telegram and WhatsApp, as well as the locLog file generated by Alpine Quest. This allows Android.Spy.1292.origin to track user whereabouts and extract sensitive data. Its modular design enables it to broaden its capabilities and engage in a wider range of malicious actions.  “As a result, Android.Spy.1292.origin not only allows user locations to be monitored but also confidential files to be hijacked. In addition, its functionality can be expanded via the download of new modules, which allows it to then execute a wider spectrum of malicious tasks.” the researchers added.  The researchers recommend installing Android apps only from trustworthy sources, such as official app stores, and avoiding Telegram groups and dodgy websites, particularly those providing free versions of commercial apps. Users should also verify app distributors, as cybercriminals frequently copy legitimate developers using identical names and logos.

Russian cybersecurity provider read more about Android Spyware Disguised as Alpine Quest App Targets Russian Military Devices

Android spyware targeting Russian military via fake mapping app. #AndroidSpyware #Cybersecurity #Russia

 Researchers have discovered at least five Android apps on Google Play that secretly function as spyware for the North Korean government. Despite passing Google Play’s security checks, these apps collect personal data from users without their knowledge. The malware, dubbed KoSpy by security firm Lookout, is embedded in utility apps that claim to assist with file management, software updates, and even device security.  However, instead of providing real benefits, these apps function as surveillance tools, gathering a range of sensitive information. KoSpy-infected apps can collect SMS messages, call logs, location data, files, nearby audio, keystrokes, Wi-Fi details, and installed apps. Additionally, they can take screenshots and record users’ screens, potentially exposing private conversations, banking credentials, and other confidential data. All collected information is sent to servers controlled by North Korean intelligence operatives, raising serious cybersecurity concerns.  Lookout researchers believe with “medium confidence” that two well-known North Korean advanced persistent threat (APT) groups, APT37 (ScarCruft) and APT43 (Kimsuki), are behind these spyware apps. These groups are known for conducting cyber espionage and targeting individuals in South Korea, the United States, and other countries. The malicious apps have been found in at least two app stores, including Google Play and Apkpure. The affected apps include 휴대폰 관리자 (Phone Manager), File Manager, 스마트 관리자 (Smart Manager), 카카오 보안 (Kakao Security), and Software Update Utility.  On the surface, these apps appear legitimate, making it difficult for users to identify them as threats. According to Ars Technica, the developer email addresses are standard Gmail accounts, and the privacy policies are hosted on Blogspot, which does not raise immediate suspicions. However, a deeper analysis of the IP addresses linked to these apps reveals connections to North Korean intelligence operations dating back to 2019. These command-and-control servers have been used for previous cyberespionage campaigns.  Google responded to the findings by stating that the “most recent app sample” was removed from Google Play before any users could download it. While this is reassuring, it highlights the ongoing risk of malicious apps bypassing security measures. Google also emphasized that its Play Protect service can detect certain malicious apps when installed, regardless of the source.   This case serves as another reminder of the risks associated with installing apps, even from official sources like Google Play. Users should always scrutinize app permissions and avoid installing unnecessary applications. A file manager, for example, should not require access to location data. By staying cautious and using reputable security tools, Android users can better protect their personal information from spyware threats.

Discover KoSpy, a North Korean spyware infiltrating Android devices via Google Play, posing significant cybersecurity threats.

 SIO, an Italian spyware company known for selling surveillance tools to government agencies, has been linked to a series of malicious Android apps designed to mimic WhatsApp and other popular services while secretly stealing private data, TechCrunch has…

Stalkerware secretly tracks your calls, messages and location. Android Phone Is Spying on You Here’s how to detect and remove these hidden spyware apps from your phone