Loading malware…
SpyDealer is an Android surveillance malware family associated with targeted espionage activity. It has been linked to operations involving the Luoyu cluster, with reporting noting overlap with XDealer and use alongside WinDealer in campaigns delivering platform-specific implants. SpyDealer is designed for covert collection from compromised mobile devices and supports persistence by registering Android broadcast receivers that trigger execution on device boot events.
Its observed surveillance capabilities include harvesting phone call history, SMS and MMS messages, contact lists, and device-identifying subscriber information such as the phone number, IMEI, and IMSI. SpyDealer can also record phone calls and ambient audio through the device microphone, and it supports camera-based surveillance by taking photos and recording video with both front and rear cameras. These behaviors are consistent with a mobile spyware implant intended for long-term monitoring of victims.
SpyDealer targets the Android platform and has been distributed through malicious mobile applications. Its functionality and campaign associations indicate use in espionage-oriented intrusions rather than commodity cybercrime.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Our colleague, who was previously involved in the research of Luoyu, shared with us the insights on this association, particularly the sharing of an encryption key between an old XDealer sample and a SpyDealer sample — suggesting a connection between both malware families.
Confirmed also via malicious mobile applications distributing SpyDealer for Android... Malware and Tools: WinDealer (Windows backdoor primary implant), SpyDealer (Android surveillance malware), custom passive MOTS injection framework operating at network infrastructure level.
...deliver malware like WinDealer (for Windows) and SpyDealer (for Android)...
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.
Initial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android surveillance malware used to monitor targeted individuals in SinisterEye operations.
Android malware delivered in campaigns leveraging adversary-in-the-middle update hijacking.
A malware family mentioned in attribution context due to a shared encryption key with an old XDealer sample.
Android malware capable of recording video and taking photos via front and rear cameras.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.