Loading story…
Researchers reported that the Scarlet Mimic threat group conducted a years-long mobile surveillance operation targeting the Uyghur community and associated activists, with activity traced from 2015 through at least mid-2022. The campaign used Android malware known as MobileOrder, delivered outside Google Play through social-engineering lures disguised as Uyghur-themed PDFs, images, and audio files, continuing a broader espionage pattern previously linked to Scarlet Mimic’s targeting of minority activists.
Once installed, the spyware enabled extensive device monitoring and control, including data theft, location tracking, call and SMS abuse, call recording, ambient audio capture, screenshot collection, remote shell access, and installation of additional APKs. Researchers said the malware evolved over time with updated string obfuscation, dead-drop resolvers hosted on Sina blogs, AES-encrypted command-and-control traffic, and a move from the AMAP SDK to Android LocationListener for real-time tracking, reinforcing the assessment that Scarlet Mimic maintained a sustained and adaptive surveillance campaign against Uyghurs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The newest MobileOrder variant discussed by Check Point was dated to mid-August 2022. Check Point linked these newer samples to Scarlet Mimic through code similarity, shared infrastructure, and victimology.
Check Point reported observing a new wave of the long-running mobile surveillance campaign in 2022. The activity continued to target Uyghurs and related supporters using updated MobileOrder spyware variants.
The campaign was first publicly linked to Scarlet Mimic in 2016. A Unit 42 report from that year covered a years-long espionage campaign targeting minority activists under the Scarlet Mimic name.
Check Point said the MobileOrder Android spyware campaign targeting the Uyghur community has been active since 2015, with more than 20 samples identified over time. The malware was spread via social-engineering lures disguised as Uyghur-themed PDFs, images, and audio files outside Google Play.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lookout disclosed multiyear Android surveillance campaigns tied to China-origin activity that targeted the Uyghur ethnic minority and, to a lesser extent, Tibetans, using spyware families including **SilkBean**, **DoubleAgent**, **CarbonSteal**, and **GoldenEagle**. The operations dated back to at least 2013 and relied on trojanized versions of legitimate apps that continued to function normally while covertly stealing contacts, messages, call records, device details, and location-related data for exfiltration to attacker-controlled infrastructure. Lookout linked the mobile activity to a broader surveillance toolkit that also included **HenBox**, **PluginPhantom**, **Spywaller**, and **DarthPusher**, and assessed that victims may have been affected across at least 14 countries, including Turkey, Kuwait, and Syria. Citizen Lab documented an earlier, highly targeted Android malware campaign against prominent Tibetans that used forged emails and trojanized **Kakao Talk** and **TuneIn Radio** APKs to compromise devices. The malware preserved normal app behavior but added hidden spying functions, including periodic beaconing to `android.uyghur.dnsd.me`, encrypted configuration retrieval, data uploads, and the ability to respond silently to SMS commands with cellular network and base-station identifiers. The findings from both organizations show a long-running pattern of mobile espionage delivered through phishing and fake third-party app stores rather than Google Play, with overlaps in Uyghur-themed infrastructure and lures pointing to sustained surveillance of dissident communities.
Aug 15, 2026
Researchers linked **Earth Empusa**—also tracked as **POISON CARP** and **Evil Eye**—to a sustained mobile espionage campaign targeting people connected to **Uyghur, Tibetan, Turkish, and Taiwanese communities**. The group used phishing messages, fake download pages, and compromised websites to deliver malware and profile victims, including an Android spyware family dubbed **ActionSpy** that impersonated the legitimate Uyghur video app **Ekran**. Trend Micro said the malware harvested device details, location, files, audio, screenshots, and camera images, and abused Android Accessibility services to steal chat content from apps including **WeChat, QQ, WhatsApp, and Viber**. The same activity overlapped with earlier reporting on large-scale surveillance of Uyghurs and with in-the-wild **iOS** watering-hole attacks documented by Google Project Zero and Google TAG. In that campaign, visitors to hacked websites were hit with multiple exploit chains spanning nearly all supported **iOS 10–12** versions, enabling installation of implants that stole **iMessages, photos, and GPS data** in real time. Google identified **14 vulnerabilities** across the chains, including browser, kernel, and sandbox-escape flaws, and Apple issued **iOS 12.1.4** after being notified, underscoring the breadth of a multi-year operation aimed at monitoring targeted communities across both Android and iPhone devices.
Aug 15, 2026
Lookout reported multiple mobile surveillance campaigns targeting officials, diplomats, military personnel, activists, and other high-value individuals across South Asia and the Middle East. In one campaign, the **Confucius APT** was linked with high confidence to the Android spyware families **Hornbill** and **SunBird**, which targeted people connected to Pakistan’s military and nuclear organizations as well as election officials in Kashmir. The malware could exfiltrate messages, geolocation, media, call records, documents, and **WhatsApp** content, while insecure command-and-control servers exposed more than **18 GB** of stolen data tied to victims in India, Pakistan, Kazakhstan, Europe, the United States, and the UAE. Lookout also detailed the earlier **Stealth Mango** and **Tangelo** surveillance operation, attributed to members of the Pakistani military, which targeted Android and iOS devices used by government officials, diplomats, military personnel, and activists in Pakistan, Afghanistan, India, Iraq, and the UAE. That campaign relied mainly on phishing through fake Facebook personas and, in some cases, physical access rather than exploits, and collected government communications, travel details, identity documents, GPS data, legal and medical records, and photos from sensitive meetings. Lookout said Google updated **Google Play Protect** and removed malicious Android apps from affected devices, while the research also tied the operators to freelance developers associated with other commercial or commodity spyware tools.
Aug 15, 2026