Loading malware…
PluginPhantom is an Android surveillance malware family associated with China-linked mobile espionage activity targeting Uyghur communities and other politically sensitive populations. It has been reported as part of a broader Android surveillance toolkit that also includes HenBox, Spywaller, DarthPusher, and ActionSpy, and has been linked to activity tracked as Earth Empusa or Evil Eye. Reporting has also noted connections between PluginPhantom and Android-targeted malware families associated with POISON CARP-related activity.
PluginPhantom has been distributed through trojanized Android applications, including Uyghur-themed apps that preserve expected functionality while covertly adding spying capabilities. Distribution has been tied to targeted social engineering and fake third-party Android app stores rather than official app marketplaces. The broader campaigns using this malware have targeted activists, journalists, dissidents, and ethnic minorities, especially Uyghurs living both inside and outside China, with observed or suspected targeting extending to multiple countries.
Within these campaigns, PluginPhantom functioned as mobile surveillanceware intended to collect and exfiltrate victim data to attacker-controlled infrastructure. Its use fits a long-running pattern of Android espionage operations focused on persistent monitoring of targeted individuals through malicious mobile applications. Public reporting has also connected some of the Android tooling used in the same operations to Chinese technology vendors, although attribution of PluginPhantom itself should be understood within the wider Earth Empusa and China-aligned mobile surveillance ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...trojanized ... applications... with two Android malware strains — ActionSpy or PluginPhantom."
"...trojanized ... applications... with two Android malware strains — ActionSpy or PluginPhantom."
4 distinct techniques documented for this family, organized by ATT&CK tactic.
The surveillance apps of these campaigns were likely distributed through a combination of targeted phishing and fake third-party app stores.
The surveillance apps of these campaigns were likely distributed through a combination of targeted phishing and fake third-party app stores.
“Social engineering: This group used fake accounts on Facebook to create fictitious personas posing as journalists, students, human rights advocates or members of the Uyghur community to build trust with people they targeted and trick them into clicking on malicious links.”
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android surveillance tool previously observed targeting Chinese-speaking individuals and members of the Uyghur ethnic minority; described as part of the same actor's mobile surveillance arsenal.
Android-targeted malware family attributed in prior reporting to POISON CARP, referenced here for attribution context (links to Chinese development companies).
Android malware delivered through trojanized apps (e.g., keyboard/prayer/dictionary) hosted on attacker-controlled fake app stores; used for surveillance against targeted communities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.