Loading malware…
Morpheus is a name used for at least two distinct malware operations: an Android spyware family and a ransomware brand. The Android Morpheus is a surveillance-oriented spyware platform for Android devices that is distributed through fake update or service-restoration applications, including ISP-themed lures delivered by SMS. It uses a staged installation flow, abuses Accessibility and overlay permissions, enables Wireless Debugging and local ADB pairing, and silently grants itself elevated control without requiring root. It can steal extensive device data, interact with applications, record audio and video, manipulate WhatsApp device linking, disable security protections such as Play Protect and mobile security tools, and maintain persistence across reboots, including through device-administrator features. Reporting has linked this Android spyware to IPS Intelligence, an Italian lawful-interception vendor, and assessed likely targeting related to surveillance operations.
Separately, Morpheus is also used as a ransomware/extortion brand associated with payloads assessed to be effectively identical to HellCat ransomware, differing mainly in branding elements. This ransomware has been observed in intrusion chains involving TransferLoader and has been used in data-theft and extortion incidents, including victim-leak-site postings and threats to publish stolen data. Research has highlighted Morpheus and HellCat as an example of rebranding and white-label practices within the ransomware-as-a-service ecosystem, complicating attribution. Because the same name refers to materially different malware families across Android spyware and Windows-focused ransomware activity, analysts should disambiguate references carefully by platform, behavior, and campaign context.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-0073 is a critical no-interaction remote code execution vulnerability in Android adbd’s ADB-over-TCP authentication path... it is an authentication bypass that lets a remote peer become an authorized ADB host and open a shell as the Android shell user.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TransferLoader malware, which later launches the Morpheus and Metasploit ransomware strains.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Once the spyware was installed, it abused Android’s in-built accessibility features, which allows the spyware to read the data on the victim’s screen and interact with other apps.
It forces users to grant dangerous permissions, including Accessibility access, which allows it to read screens, interact with apps, and capture sensitive data.
Once the spyware was installed, it abused Android’s in-built accessibility features, which allows the spyware to read the data on the victim’s screen and interact with other apps.
It forces users to grant dangerous permissions, including Accessibility access, which allows it to read screens, interact with apps, and capture sensitive data.
It can trick victims into approving actions like linking a WhatsApp account by showing a fake biometric prompt.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named extortion actor/group claiming theft of a large volume of financial-sector data.
A named extortion/ransomware operation that allegedly stole 680 GB of HDFC AMC data and threatened publication via a Tor-based leak site. The article characterizes it as a data-extortion-only operation that may pressure victims through leak-site listings rather than necessarily encrypting files.
Android spyware delivered via fake update apps and SMS phishing links impersonating an ISP. It uses a dropper and hidden second-stage payload, abuses Accessibility and overlay permissions, enables Wireless Debugging and ADB pairing, disables security tools, gains persistence across reboots, and supports covert surveillance including audio/video recording, WhatsApp device pairing, evidence erasure, and weakening device protections.
Android spyware linked by researchers to IPS, an Italian lawful-interception vendor. It is delivered via fake Android/update apps, abuses Android accessibility features, steals broad device data, and can gain access to WhatsApp by spoofing the app and tricking the victim into biometric approval for device linking.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.