Loading malware…
ActionSpy is an Android spyware family associated with the China-aligned espionage actor Earth Empusa, also known as Evil Eye and POISON CARP. It has been used in mobile surveillance campaigns targeting individuals connected to Uyghur, Tibetan, Turkish, and Taiwanese communities, including activists, journalists, dissidents, and other persons of intelligence interest. Evidence indicates the malware has existed since at least 2017 and was actively deployed in 2020 as part of broader mobile intrusion operations that also included watering-hole activity and iOS exploitation by the same actor.
ActionSpy is typically delivered through socially engineered Android application lures and phishing infrastructure, including trojanized apps masquerading as legitimate Uyghur- or Tibetan-themed software. A documented example impersonated the legitimate Uyghur video application Ekran. The malware embeds the legitimate application and uses a virtualization framework to present the expected user experience while covertly operating the spyware in parallel, improving deception and reducing user suspicion. It also employs commercial packing and encrypted configuration data to hinder analysis and detection.
Once installed, ActionSpy establishes regular communication with command-and-control infrastructure and transmits detailed device metadata. Its surveillance feature set is extensive and includes collection of location data, contacts, call logs, SMS messages, browser bookmarks, installed applications, running processes, Wi-Fi-related information, and file listings, along with file upload capability. It also supports audio recording, camera capture, and screenshot collection, making it a full-featured mobile espionage implant.
A notable capability is its abuse of Android Accessibility services for chat surveillance. By persuading the victim to enable Accessibility under a benign pretext, ActionSpy can monitor interface events from messaging applications and extract nicknames, message content, and timestamps from WeChat, QQ, WhatsApp, and Viber. The malware stores harvested chat data locally and can later package and exfiltrate it on command. This behavior makes ActionSpy particularly suited for long-term monitoring of communications on targeted Android devices.
Overall, ActionSpy is a purpose-built Android surveillance implant used in targeted espionage operations. Its combination of app impersonation, anti-analysis measures, broad device and communications collection, and operator-controlled exfiltration reflects a mature mobile spyware capability aligned with strategic intelligence collection rather than indiscriminate cybercrime.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
we identified an undocumented Android spyware we have named ActionSpy (detected by Trend Micro as AndroidOS_ActionSpy.HRX).
we identified an undocumented Android spyware we have named ActionSpy (detected by Trend Micro as AndroidOS_ActionSpy.HRX).
we identified an undocumented Android spyware we have named ActionSpy (detected by Trend Micro as AndroidOS_ActionSpy.HRX).
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Earth Empusa also employs watering hole attacks to compromise iOS devices. The group injected their malicious scripts on websites that their targets could potentially visit and load the injected script from it.
Once the user enables the Accessibility service, ActionSpy will monitor Accessibility events on the device... ActionSpy checks if the event type is VIEW_SCROLLED or WINDOW_CONTENT_CHANGED and then check if the events came from targeted apps like WeChat, QQ, WhatsApp, and Viber.
Every 30 seconds, ActionSpy will collect basic device information like IMEI, phone number, manufacturer, battery status, etc., which it sends to the C&C server as a heartbeat request.
ActionSpy supports the following modules: ... contacts Get contacts info calling Get call logs sms Get SMS messages ... dir Collect specific types of file list on SDCard ... file Upload files from device to C&C server
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android-targeted spyware/malware family attributed in prior reporting to POISON CARP, referenced here for attribution context (links to Chinese development companies).
Android malware embedded in trojanized Uyghur-themed apps distributed via fake third-party app stores to enable surveillance of targeted users.
Android spyware used by Earth Empusa that impersonates the legitimate Uyghur video app Ekran, collects device information, contacts, SMS, call logs, files, location, screenshots, audio, camera images, and abuses Android Accessibility to harvest chat logs from WeChat, QQ, WhatsApp, and Viber. It communicates with C2 over HTTP using RSA-encrypted traffic and stores configuration encrypted with DES.
Android spyware used in phishing campaigns attributed to Earth Empusa. It impersonates the legitimate Uyghur video app Ekran, collects device information, contacts, call logs, SMS, files, location, screenshots, photos, audio, and abuses Android Accessibility to harvest chat logs from messaging apps including WeChat, QQ, WhatsApp, and Viber.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.