Loading malware…
CarbonSteal is an Android surveillance malware family associated with China-aligned mobile espionage activity linked to GREF, also tracked as APT15, Ke3chang, Mirage, Vixen Panda, and Playful Dragon. It has been used in campaigns dating back to at least the mid-2010s, primarily against the Uyghur ethnic minority and, to a lesser extent, Tibetans, as part of a broader cluster of Android surveillance tools that also includes SilkBean, DoubleAgent, and GoldenEagle.
CarbonSteal commonly appears in trojanized Android applications that preserve expected app functionality while covertly adding spying features. It has impersonated trusted and popular software categories including official Google applications, chat tools, VPN applications, and games, consistent with targeted social-engineering and third-party app-store distribution. Distribution has been associated with targeted phishing and fake app marketplaces rather than official mainstream app stores.
The malware is designed for device surveillance and victim profiling. Reported capabilities include access to SMS and MMS messages, discovery of selected installed applications, collection of device metadata such as model, manufacturer, storage, memory, CPU, and serial information, and harvesting of mobile network details including cellular identifiers and operator-related metadata. CarbonSteal has also been observed manipulating local artifacts for defense evasion, including deleting call log entries associated with attacker communications.
CarbonSteal fits a broader espionage toolkit focused on covert collection and exfiltration of personal and device data from Android users of intelligence interest. Its operational use, targeting patterns, and overlap with other GREF mobile malware families place it within a sustained surveillance ecosystem aimed at politically sensitive communities and users across multiple countries.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Lookout Threat Intelligence team has discovered four Android surveillanceware tools, which we named SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android surveillanceware used in larger China-linked mobile APT campaigns to gather and exfiltrate personal user data to attacker-operated command-and-control servers; many samples were trojanized legitimate apps.
CarbonSteal is an Android surveillanceware used by APT15 to collect sensitive information from mobile devices.
Trojan referenced as one of the malware families previously used by GREF in similar targeting.
Software changes: CarbonSteal
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.