Loading story…
Researchers said China-aligned espionage group GREF distributed trojanized Android messaging apps, Signal Plus Messenger and FlyGram, through Google Play, the Samsung Galaxy Store, dedicated websites, and in FlyGram’s case a Uyghur-focused Telegram channel. The apps carried the BadBazaar spyware family and were tied to targeting patterns previously associated with Uyghurs and other Turkic minorities. Google removed the malicious apps after notification, but ESET reported they were still present in Samsung’s store at the time of publication.
Signal Plus Messenger abused Signal’s legitimate linked-device feature in what researchers described as the first documented case of covert Signal account spying through secret device linking, allowing attackers to intercept messages without alerting victims. FlyGram impersonated Telegram and stole device and Telegram-related data, while a malicious Cloud Sync feature uploaded backups and metadata to attacker-controlled servers; ESET observed at least 13,953 accounts enabling that feature. Researchers said the fake Signal app saw fewer than 500 downloads on Google Play, suggesting a more targeted operation than broad consumer malware distribution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
ESET publicly disclosed two active Android espionage campaigns using trojanized Signal Plus Messenger and FlyGram apps, attributing them with high confidence to the China-aligned GREF group. The research also described the first documented abuse of Signal's linked-device feature for covert message spying.
Google removed Signal Plus Messenger from Google Play on May 23, 2023 after notification from ESET. Forbes also reported that Google removed both malicious apps after ESET notified the company.
Forbes reported that Samsung had been notified about the malicious apps in May but had reportedly not removed them by the time of reporting. ESET likewise said both apps were still available in the Samsung Galaxy Store at the time of writing.
ESET said it reported the malicious Signal Plus Messenger app to Google on April 27, 2023. This preceded Google's removal of the app from Google Play.
ESET reported that the trojanized Signal app Signal Plus Messenger was initially uploaded to Google Play on July 7, 2022. The app impersonated Signal and was later tied to GREF and BadBazaar.
ESET said FlyGram was removed from Google Play sometime after January 6, 2021. Before removal, it had received more than 5,000 installs on the platform.
A link to download FlyGram was posted in a Uyghur Telegram group focused on Android app sharing. ESET cited this as consistent with prior BadBazaar targeting of Uyghurs and other Turkic minorities.
ESET reported that the trojanized Telegram app FlyGram was initially uploaded to Google Play around June 4, 2020. The app was later attributed to the China-aligned GREF group and linked to the BadBazaar malware family.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lookout disclosed multiyear Android surveillance campaigns tied to China-origin activity that targeted the Uyghur ethnic minority and, to a lesser extent, Tibetans, using spyware families including **SilkBean**, **DoubleAgent**, **CarbonSteal**, and **GoldenEagle**. The operations dated back to at least 2013 and relied on trojanized versions of legitimate apps that continued to function normally while covertly stealing contacts, messages, call records, device details, and location-related data for exfiltration to attacker-controlled infrastructure. Lookout linked the mobile activity to a broader surveillance toolkit that also included **HenBox**, **PluginPhantom**, **Spywaller**, and **DarthPusher**, and assessed that victims may have been affected across at least 14 countries, including Turkey, Kuwait, and Syria. Citizen Lab documented an earlier, highly targeted Android malware campaign against prominent Tibetans that used forged emails and trojanized **Kakao Talk** and **TuneIn Radio** APKs to compromise devices. The malware preserved normal app behavior but added hidden spying functions, including periodic beaconing to `android.uyghur.dnsd.me`, encrypted configuration retrieval, data uploads, and the ability to respond silently to SMS commands with cellular network and base-station identifiers. The findings from both organizations show a long-running pattern of mobile espionage delivered through phishing and fake third-party app stores rather than Google Play, with overlaps in Uyghur-themed infrastructure and lures pointing to sustained surveillance of dissident communities.
Aug 15, 2026
A coalition of agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published advisories identifying the mobile spyware families **BadBazaar** and **Moonshine** in dozens of legitimate-looking apps. The malware was disguised as Android prayer apps, messaging tools, PDF readers, and utility apps, and one iOS app, **`TibetOne`**, was also named. Officials said the spyware targeted civil society groups and people connected to issues viewed by the Chinese state as sensitive, including Uyghur, Tibetan, Taiwanese, Hong Kong democracy, and Falun Gong communities. Technical analysis from the Australian Cyber Security Centre said **Moonshine** was distributed through trojanized apps, social media, messaging platforms, and in some cases official app stores, while **BadBazaar** included Android and iOS variants such as **BadSolar** and **BadSignal**. The spyware can collect files, chats, photos, location data, audio, and device information, giving operators broad surveillance access to cameras and microphones. Investigators also reported infrastructure overlaps tied to social-engineering assets, reused registration details, SSL certificate artifacts, and activity previously associated with **TA413**, **APT5**, **APT14**, and infrastructure linked to **UPSEC**.
Jun 29, 2026
The UK National Cyber Security Centre and international government partners warned that the **BADBAZAAR** and **MOONSHINE** spyware families are being used to target mobile users linked to **Uyghur, Tibetan, Taiwanese, Hong Kong, Xinjiang, democracy, and Falun Gong** issues. The malware is delivered through trojanized Android and iOS apps that masquerade as legitimate software, sometimes impersonating brands such as **WhatsApp** and **Skype**, and has been spread via social media, messaging platforms, third-party download sites, and in some cases official app stores. Agencies said the targeting aligns with subjects the Chinese state views as threatening to its stability, and assessed that the stolen data would almost certainly be valuable to Beijing. The spyware can covertly collect messages, files, photos, device information, and location data, while also enabling access to microphones and cameras for real-time surveillance. The advisory cited examples including the **MOONSHINE** sample `ئاۋازلىق قۇرئان.apk` aimed at Uyghur users and the **BADBAZAAR**-linked **TibetOne** iOS app, supported by infrastructure such as `tibetone[.]org` and promoted through Telegram and Reddit. Officials urged at-risk users to install apps only from trusted sources, keep devices updated, avoid rooted or jailbroken phones, review app permissions regularly, and report suspicious links, accounts, and messages; a companion technical advisory also called on app store operators, developers, and social media companies to help detect and disrupt the campaign.
Aug 15, 2026