Loading story…
Researchers reported that the VajraSpy Android remote access trojan was used in a cyberespionage campaign attributed to the Patchwork APT group, also tracked as APT-Q-43/VajraEleph, with victims primarily in Pakistan. The malware was embedded in at least 12 trojanized Android applications, including six that were available on Google Play and amassed more than 1,400 installs before removal, while others were distributed outside the store. Most of the apps impersonated messaging platforms, including a fake chat app called "Crazy Talk", and investigators said the operation likely relied in part on honey-trap romance lures to reach targets such as Pakistani military personnel and other users of interest.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ESET reported with high confidence that the Patchwork APT group operated a VajraSpy campaign using 12 trojanized Android apps, including six distributed via Google Play and six found outside the store. The company said the Google Play apps accumulated more than 1,400 installs before removal and that the campaign primarily targeted users in Pakistan, likely through honey-trap romance scams.
K7 Labs published an analysis of VajraSpy, an Android remote access trojan attributed to APT-Q-43/VajraEleph. The report described a sample disguised as the chat app "Crazy Talk" that abused accessibility and notification permissions and used Firebase services to exfiltrate stolen data, including messages from WhatsApp, WhatsApp Business, and Signal.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SophosLabs reported a spyware campaign targeting Android users in Pakistan through Trojanized apps disguised as trusted local services, including **Pakistan Citizen Portal**, **Pakistan Salat Time**, **Mobile Packages Pakistan**, **Registered SIMs Checker**, **TPL Insurance**, and a fake **Pakistan Chat** app. Once installed, the apps profiled devices and stole contacts, SMS messages, call logs, location data, storage listings, and photos; some variants also harvested credentials and national identity information. The malware used spoofed domains including `pmdu.info`, `pakchat.online`, `tplinsurance.xyz`, and `kv33.zapto.org`, with command-and-control infrastructure hosted in the Netherlands, Latvia, Bulgaria, and the United States. Sophos said the spyware relied on app mimicry, disguised package names, AES-encrypted strings, XOR-encoded data theft, and delayed delivery of core spying functions through downloaded DEX payloads, indicating an actively developed surveillance operation tracked as **Andr/Spy-BDD**.
Aug 14, 2026
ESET reported that an Android espionage operation dubbed **eXotic Visit** distributed trojanized but working mobile apps—primarily fake messaging services—to deliver the custom **XploitSPY** malware. The campaign was active from at least late 2021 through the end of 2023 and spread through dedicated websites, GitHub, alternative app stores, and **Google Play**. Researchers said the activity appears to have mainly targeted users in **Pakistan** and **India**, and they track the operators as **Virtual Invaders** without a confirmed link to any previously known threat group. The malware gave operators broad surveillance and remote-control access, including theft of contacts, SMS messages, call logs, files, location data, notifications, audio recordings, and photos. ESET said later variants improved stealth with obfuscation, emulator detection, Firebase-based command-and-control retrieval, and native libraries used to conceal C2 details. The company identified about **380 compromised accounts** across some of the malicious apps and reported multiple samples to Google, which removed the affected apps from Google Play.
Aug 14, 2026
ESET reported that **Transparent Tribe** (also tracked as **APT36**) ran an Android espionage campaign that used trojanized messaging apps, **MeetsApp** and **MeetUp**, to infect people in India and Pakistan who likely had military or political relevance. The operation appears to have relied on honey-trap romance lures, directing targets to fake download sites instead of Google Play, while the apps retained normal chat features to avoid suspicion and covertly installed the **CapraRAT** backdoor. Once installed, the malware enabled broad surveillance, including screenshots, photo capture, audio and call recording, SMS access, contact theft, file exfiltration, and location tracking. ESET linked the activity to Transparent Tribe through reused CapraRAT code, shared command-and-control infrastructure, the same signing certificate, and overlap with domains previously tied to the group; researchers also said poor operator security exposed victim data, allowing them to identify more than 150 victims across India, Pakistan, Russia, Oman, and Egypt.
Jul 12, 2026