Loading threat actor…
Evil Eye is a China-nexus espionage threat actor associated with surveillance and exploitation campaigns targeting Uyghur communities. The group has been linked to mobile-device compromise operations delivered through compromised Uyghur websites and has been assessed as overlapping with operators behind earlier campaigns documented against Uyghurs and Tibetans, including activity tracked as POISON CARP. Evil Eye has been observed using one-click mobile browser exploitation to install spyware on both Android and iOS devices, representing a comparatively sophisticated capability focused on monitoring individuals of intelligence interest. The actor’s tradecraft includes watering-hole compromises, malicious iframes, user-agent filtering, staged exploit delivery, and use of the IRONSQUIRREL framework to serve iOS exploit chains. On iOS, Evil Eye deployed an implant known as INSOMNIA, assessed as an updated variant of spyware previously described in public reporting on Uyghur-targeted exploitation. INSOMNIA operated with elevated privileges, used HTTPS command-and-control with embedded-certificate validation, and collected sensitive device and application data. Reported targeting included communications and privacy-focused applications such as Signal, ProtonMail, and WeChat. The implant reportedly lacked persistence, requiring the operators to exploit devices again after reboot. Related activity tied to the same broader operator set also used Android exploitation and modular spyware frameworks. Reporting linked overlapping infrastructure, exploit material, and spyware development to campaigns against Tibetan organizations and senior Tibetan figures, where the operator tracked as POISON CARP used mobile browser exploits and Android spyware referred to as MOONSHINE and Scotch. Those operations included social engineering over WhatsApp, exploitation of mobile browsers, surveillance-oriented plugin modules, and collection of messages, contacts, call logs, location, microphone audio, camera images, screenshots, notifications, and shell access. The actor’s behavior is consistent with state-sponsored intelligence collection aligned with Chinese security interests in ethnic minority communities, especially Uyghur and Tibetan targets. Known aliases and related designations include evileye, evil_eye, and likely overlap with POISON CARP in adjacent reporting.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
71 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named espionage campaign reported by Volexity targeting Uyghurs through compromised websites and Android malware. The content links it to POISON CARP through shared infrastructure and likely common or coordinated operators.
Targeting Uyghur Muslims in Xinjiang with iOS spyware implants for surveillance and intelligence gathering.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.