Loading malware…
DoubleAgent is an Android surveillance malware family used in long-running mobile espionage campaigns associated with China-linked activity targeting Uyghur communities and, to a lesser extent, Tibetans. It has been active since at least 2013 as part of a broader cluster of Android surveillance tools that also includes SilkBean, CarbonSteal, and GoldenEagle, and has been linked in reporting to the GREF / APT15 / Ke3chang / Mirage / Vixen Panda / Playful Dragon nexus. The malware’s primary purpose is covert collection and exfiltration of victim data from compromised devices.
DoubleAgent has been observed embedded in trojanized Android applications that preserve expected app functionality while adding hidden spying features. Reported lures included repackaged communication and news applications, consistent with targeted delivery through phishing and fake third-party app stores rather than official marketplaces. The campaigns were tailored to communities of intelligence interest and were not confined to China, with indications of targeting across multiple countries.
On infected devices, DoubleAgent can enumerate installed applications, gather common system information, access contact lists and call logs, capture SMS and MMS messages, and collect files from device storage. It also supports deleting or renaming specific files, indicating an element of defense evasion and artifact management on the host. For exfiltration, DoubleAgent has been documented using FTP and raw TCP socket communications.
Overall, DoubleAgent is best characterized as Android spyware or surveillanceware used for targeted intelligence collection through trojanized apps and social-engineering-driven distribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Lookout Threat Intelligence team has discovered four Android surveillanceware tools, which we named SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
The surveillance apps of these campaigns were likely distributed through a combination of targeted phishing and fake third-party app stores.
Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android surveillanceware used in larger China-linked mobile APT campaigns to gather and exfiltrate personal user data to attacker-operated command-and-control servers; many samples were trojanized legitimate apps.
DoubleAgent is an Android surveillanceware used by APT15 for espionage and monitoring of targeted individuals.
Named malware referenced through overlapping C2 infrastructure with BADBAZAAR-linked domains.
Android surveillanceware family reported by Lookout (2020) that shares C2 infrastructure with BadBazaar, suggesting common management/operation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.