Loading story…
Trend Micro reported that the AnubisSpy Android spyware family targeted Arabic-speaking users across the Middle East by posing as benign mobile apps on Google Play and third-party marketplaces. The lures were often written in Arabic and themed around Egypt and regional sociopolitical topics, including apps such as SisiFans and SwiftClinic. Researchers linked the malware to the Sphinx (APT-C-15) cyberespionage campaign through shared command-and-control infrastructure, similar file structures, a common JSON decryption method, and overlapping regional targeting.
Once installed, AnubisSpy could exfiltrate SMS messages, contacts, emails, calendar events, browser history, photos, videos, location data, screenshots, and device information, while also collecting communications from apps including Skype, WhatsApp, Facebook, Twitter, Viber, and Gmail. The spyware also supported command execution, APK installation and removal, audio and call recording, and self-deletion after sending encrypted data to its command-and-control server, with some functions expanded on rooted devices. Trend Micro said development artifacts dated the operation to at least 2015, and Google removed the identified apps after disclosure and updated Google Play Protect to detect them.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The latest analyzed AnubisSpy variant carried a signing timestamp from May 2017. Across the campaign, Trend Micro identified at least seven malicious apps signed with the same fake Google certificate.
Trend Micro reported that the earliest analyzed AnubisSpy sample was signed in June 2015. The malware was distributed through malicious Android apps on Google Play and third-party marketplaces.
Hardcoded agent version strings indicated the AnubisSpy Android spyware apps were developed as early as April 2015. The apps were written in Arabic and themed around Egypt and Middle Eastern news or sociopolitical topics.
Trend Micro said the related Sphinx cyberespionage campaign was active between June 2014 and November 2015, with malware timestamps suggesting activity may have started as early as 2011. Sphinx primarily used watering-hole delivery via social media and customized njRAT payloads.
Google updated Google Play Protect to detect and take action against the verified policy-violating AnubisSpy apps. This followed Trend Micro's disclosure of the malicious applications.
Following disclosure, Google removed the identified AnubisSpy applications from Google Play. One masquerading app, SisiFans, had accumulated 150 installs before removal.
After analyzing the spyware-laced apps, Trend Micro disclosed the identified AnubisSpy applications to Google. Coordination with Google also showed the apps had been installed in several Middle Eastern countries.
Trend Micro assessed that the Android spyware family AnubisSpy was linked to the Sphinx (APT-C-15) cyberespionage campaign. The linkage was based on a shared command-and-control server at 86.105.18.107, similar file structures, shared JSON decryption technique, and overlapping Middle East targeting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT-C-23, also known as **Two-tailed Scorpion** or **C-23**, deployed updated Android spyware against users in the Middle East, with reporting pointing to victims especially in the Palestinian Territories. The malware was disguised as benign update or installer apps, including **"App Updates," "System Apps Updates," "Android Update Intelligence,"** and a fake Google Play or Telegram-themed application using the package name `org.telegram.light`. Researchers said the campaign likely relied on phishing links sent by SMS and fake Android app stores to trick targets into installing the spyware and granting high-risk permissions such as device administrator, notification access, accessibility monitoring, and third-party app installation. The newer variants expanded both stealth and resilience. After installation, the spyware could rename itself and swap icons to resemble trusted apps such as **Google Play**, **YouTube**, **Google**, or **Botim**, making removal harder for victims. It also supported post-deployment command-and-control updates and Firebase-based messaging to maintain communications if infrastructure changed. Once active, the malware could exfiltrate SMS messages, contacts, call logs, files, screenshots, audio recordings, pictures, and notifications from messaging apps including WhatsApp, while also placing calls, disabling Wi‑Fi, and in some cases deleting device data.
Aug 15, 2026
Two Android apps published on Google Play, **Currency Converter** and **BatterySaverMobi**, were found to function as droppers for the **Anubis** banking trojan. The apps used motion-sensor checks to detect whether they were running on a real device rather than in a sandbox or emulator, then fetched command-and-control details through encoded requests tied to Telegram and Twitter pages. After installation, they displayed a fake system update prompt designed to persuade users to sideload a malicious APK that delivered the Anubis payload. Once deployed, Anubis was capable of targeting **377 financial app variants across 93 countries** and stealing data through keylogging, screenshots, abuse of Android accessibility features, and broad device permissions. Researchers linked the activity to infrastructure including the domain `aserogeege.space`, and Google removed both malicious apps from the Play Store after the discovery.
Jun 29, 2026
SentinelLABS reported that the **Arid Viper** threat actor continued deploying its `SpyC23` Android spyware in 2022 and 2023 through weaponized applications posing as Telegram-themed tools and a dating-themed app called **Skipped Messenger**. The campaign targeted victims in the Middle East, with a notable focus on Arabic-speaking users, and aligns with the group’s long-running mobile espionage activity linked to Hamas interests. Researchers found substantial code and functionality overlap between recent `SpyC23` samples and older Arid Viper Android malware families including `GnatSpy`, `FrozenCell`, and `VAMP`, reinforcing attribution. The spyware sought broad device permissions to enable location tracking, call monitoring and recording, contact and storage access, notification reading, and silent file downloads, while also using obfuscation, anti-decompilation, and anti-virtualization techniques and command-and-control naming patterns consistent with the actor’s established infrastructure.
Jul 12, 2026