New spyware campaigns target privacy-conscious Android users in the UAE
Essential information
- Published
- 02/10/2025 16:14
- Modified
- 02/10/2025 16:46
- Tags
- 2025-10-02 android android/spy.prospy android/spy.tospy app impersonation data exfiltration persistence phishing signal spyware totok uae
- Related entities
- 30 observables, 2 techniques (mitre), 1 others
Description
Two Android spyware campaigns, ProSpy and ToSpy, have been discovered targeting users in the United Arab Emirates. These campaigns impersonate secure messaging apps like Signal and ToTok, distributing malware through deceptive websites and social engineering tactics. Once installed, the spyware exfiltrates sensitive data including contacts, SMS messages, files, and device information. The campaigns use persistence mechanisms to ensure continuous operation on compromised devices. ProSpy disguises itself as encryption plugins or pro versions of apps, while ToSpy exclusively mimics the ToTok app. The malware is distributed through unofficial sources, highlighting the risks of downloading apps outside official app stores.