Loading story…
The UK National Cyber Security Centre and international government partners warned that the BADBAZAAR and MOONSHINE spyware families are being used to target mobile users linked to Uyghur, Tibetan, Taiwanese, Hong Kong, Xinjiang, democracy, and Falun Gong issues. The malware is delivered through trojanized Android and iOS apps that masquerade as legitimate software, sometimes impersonating brands such as WhatsApp and Skype, and has been spread via social media, messaging platforms, third-party download sites, and in some cases official app stores. Agencies said the targeting aligns with subjects the Chinese state views as threatening to its stability, and assessed that the stolen data would almost certainly be valuable to Beijing.
The spyware can covertly collect messages, files, photos, device information, and location data, while also enabling access to microphones and cameras for real-time surveillance. The advisory cited examples including the MOONSHINE sample ئاۋازلىق قۇرئان.apk aimed at Uyghur users and the BADBAZAAR-linked TibetOne iOS app, supported by infrastructure such as tibetone[.]org and promoted through Telegram and Reddit. Officials urged at-risk users to install apps only from trusted sources, keep devices updated, avoid rooted or jailbroken phones, review app permissions regularly, and report suspicious links, accounts, and messages; a companion technical advisory also called on app store operators, developers, and social media companies to help detect and disrupt the campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 9 April 2025, the UK NCSC and international partners jointly published public guidance and a technical advisory on the BADBAZAAR and MOONSHINE spyware families. The advisories warned that trojanized mobile apps were being used to target Uyghur, Tibetan, Taiwanese, and other civil society communities linked to issues the Chinese state considers threatening.
The advisory says the BADBAZAAR-linked iOS app TibetOne was uploaded to the Apple App Store in December 2021 as part of targeting Tibetans. It later became unavailable on the store.
The joint advisory states that Citizen Lab reported in 2019 that the Android spyware family MOONSHINE was targeting Tibetan groups.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coalition of agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published advisories identifying the mobile spyware families **BadBazaar** and **Moonshine** in dozens of legitimate-looking apps. The malware was disguised as Android prayer apps, messaging tools, PDF readers, and utility apps, and one iOS app, **`TibetOne`**, was also named. Officials said the spyware targeted civil society groups and people connected to issues viewed by the Chinese state as sensitive, including Uyghur, Tibetan, Taiwanese, Hong Kong democracy, and Falun Gong communities. Technical analysis from the Australian Cyber Security Centre said **Moonshine** was distributed through trojanized apps, social media, messaging platforms, and in some cases official app stores, while **BadBazaar** included Android and iOS variants such as **BadSolar** and **BadSignal**. The spyware can collect files, chats, photos, location data, audio, and device information, giving operators broad surveillance access to cameras and microphones. Investigators also reported infrastructure overlaps tied to social-engineering assets, reused registration details, SSL certificate artifacts, and activity previously associated with **TA413**, **APT5**, **APT14**, and infrastructure linked to **UPSEC**.
Jun 29, 2026
Lookout disclosed multiyear Android surveillance campaigns tied to China-origin activity that targeted the Uyghur ethnic minority and, to a lesser extent, Tibetans, using spyware families including **SilkBean**, **DoubleAgent**, **CarbonSteal**, and **GoldenEagle**. The operations dated back to at least 2013 and relied on trojanized versions of legitimate apps that continued to function normally while covertly stealing contacts, messages, call records, device details, and location-related data for exfiltration to attacker-controlled infrastructure. Lookout linked the mobile activity to a broader surveillance toolkit that also included **HenBox**, **PluginPhantom**, **Spywaller**, and **DarthPusher**, and assessed that victims may have been affected across at least 14 countries, including Turkey, Kuwait, and Syria. Citizen Lab documented an earlier, highly targeted Android malware campaign against prominent Tibetans that used forged emails and trojanized **Kakao Talk** and **TuneIn Radio** APKs to compromise devices. The malware preserved normal app behavior but added hidden spying functions, including periodic beaconing to `android.uyghur.dnsd.me`, encrypted configuration retrieval, data uploads, and the ability to respond silently to SMS commands with cellular network and base-station identifiers. The findings from both organizations show a long-running pattern of mobile espionage delivered through phishing and fake third-party app stores rather than Google Play, with overlaps in Uyghur-themed infrastructure and lures pointing to sustained surveillance of dissident communities.
Aug 15, 2026
Researchers said China-aligned espionage group **GREF** distributed trojanized Android messaging apps, **Signal Plus Messenger** and **FlyGram**, through **Google Play**, the **Samsung Galaxy Store**, dedicated websites, and in FlyGram’s case a Uyghur-focused Telegram channel. The apps carried the **BadBazaar** spyware family and were tied to targeting patterns previously associated with **Uyghurs and other Turkic minorities**. Google removed the malicious apps after notification, but ESET reported they were still present in Samsung’s store at the time of publication. **Signal Plus Messenger** abused Signal’s legitimate linked-device feature in what researchers described as the first documented case of covert Signal account spying through secret device linking, allowing attackers to intercept messages without alerting victims. **FlyGram** impersonated Telegram and stole device and Telegram-related data, while a malicious **Cloud Sync** feature uploaded backups and metadata to attacker-controlled servers; ESET observed at least **13,953 accounts** enabling that feature. Researchers said the fake Signal app saw fewer than **500 downloads** on Google Play, suggesting a more targeted operation than broad consumer malware distribution.
Aug 15, 2026