Loading story…
APT-C-23, also known as Two-tailed Scorpion or C-23, deployed updated Android spyware against users in the Middle East, with reporting pointing to victims especially in the Palestinian Territories. The malware was disguised as benign update or installer apps, including "App Updates," "System Apps Updates," "Android Update Intelligence," and a fake Google Play or Telegram-themed application using the package name org.telegram.light. Researchers said the campaign likely relied on phishing links sent by SMS and fake Android app stores to trick targets into installing the spyware and granting high-risk permissions such as device administrator, notification access, accessibility monitoring, and third-party app installation.
The newer variants expanded both stealth and resilience. After installation, the spyware could rename itself and swap icons to resemble trusted apps such as Google Play, YouTube, Google, or Botim, making removal harder for victims. It also supported post-deployment command-and-control updates and Firebase-based messaging to maintain communications if infrastructure changed. Once active, the malware could exfiltrate SMS messages, contacts, call logs, files, screenshots, audio recordings, pictures, and notifications from messaging apps including WhatsApp, while also placing calls, disabling Wi‑Fi, and in some cases deleting device data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On September 15, 2021, Cyble Research Labs published analysis of a new Android spyware variant attributed to APT-C-23 targeting users in the Middle East. The malware masqueraded as a Google Play installer with Telegram-like branding and sought extensive permissions to steal data and control infected devices.
ESET documented an Android espionage campaign in the Middle East built around a malicious chat app called Welcome Chat that functioned as a real messenger while covertly stealing SMS messages, call logs, contacts, photos, recordings, location, and device data. The researchers linked the operation to the long-running BadPatch campaign associated with Gaza Hackers/Molerats based on shared infrastructure and malware-family overlap.
Sophos said the C-23 threat actor, also known as GnatSpy, FrozenCell, and VAMP, has been active since at least 2017. This establishes the earliest explicitly dated activity mentioned in the references.
Sophos analyzed newly discovered Android spyware variants attributed to C-23 that improved persistence, stealth, and resilience, including the ability to change command-and-control addresses after deployment and disguise themselves as legitimate apps. Sophos said the campaign targeted individuals in the Middle East, especially in the Palestinian Territories, and shared details with the Android security team.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceblog.cyble.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **APT-C-23** threat group evolved its Android spyware toolkit, indicating continued investment in mobile-focused espionage operations. The updated malware was tied to the group’s broader surveillance activity and reflects an effort to improve data collection from compromised Android devices, including access to sensitive user information and device content. The report said the spyware’s development shows a maturing capability set aimed at stealthier and more effective monitoring of targets through mobile malware. The activity reinforces the risk posed by state-aligned or politically motivated actors using Android implants to harvest communications, files, and other intelligence from victims’ phones.
Jun 29, 2026
SentinelLABS reported that the **Arid Viper** threat actor continued deploying its `SpyC23` Android spyware in 2022 and 2023 through weaponized applications posing as Telegram-themed tools and a dating-themed app called **Skipped Messenger**. The campaign targeted victims in the Middle East, with a notable focus on Arabic-speaking users, and aligns with the group’s long-running mobile espionage activity linked to Hamas interests. Researchers found substantial code and functionality overlap between recent `SpyC23` samples and older Arid Viper Android malware families including `GnatSpy`, `FrozenCell`, and `VAMP`, reinforcing attribution. The spyware sought broad device permissions to enable location tracking, call monitoring and recording, contact and storage access, notification reading, and silent file downloads, while also using obfuscation, anti-decompilation, and anti-virtualization techniques and command-and-control naming patterns consistent with the actor’s established infrastructure.
Jul 12, 2026
Trend Micro reported that the **AnubisSpy** Android spyware family targeted Arabic-speaking users across the Middle East by posing as benign mobile apps on **Google Play** and third-party marketplaces. The lures were often written in Arabic and themed around Egypt and regional sociopolitical topics, including apps such as **SisiFans** and **SwiftClinic**. Researchers linked the malware to the **Sphinx** (`APT-C-15`) cyberespionage campaign through shared command-and-control infrastructure, similar file structures, a common JSON decryption method, and overlapping regional targeting. Once installed, AnubisSpy could exfiltrate **SMS messages, contacts, emails, calendar events, browser history, photos, videos, location data, screenshots, and device information**, while also collecting communications from apps including **Skype, WhatsApp, Facebook, Twitter, Viber, and Gmail**. The spyware also supported command execution, APK installation and removal, audio and call recording, and self-deletion after sending encrypted data to its command-and-control server, with some functions expanded on rooted devices. Trend Micro said development artifacts dated the operation to at least 2015, and Google removed the identified apps after disclosure and updated **Google Play Protect** to detect them.
Aug 15, 2026