Loading story…
SophosLabs reported a spyware campaign targeting Android users in Pakistan through Trojanized apps disguised as trusted local services, including Pakistan Citizen Portal, Pakistan Salat Time, Mobile Packages Pakistan, Registered SIMs Checker, TPL Insurance, and a fake Pakistan Chat app. Once installed, the apps profiled devices and stole contacts, SMS messages, call logs, location data, storage listings, and photos; some variants also harvested credentials and national identity information.
The malware used spoofed domains including pmdu.info, pakchat.online, tplinsurance.xyz, and kv33.zapto.org, with command-and-control infrastructure hosted in the Netherlands, Latvia, Bulgaria, and the United States. Sophos said the spyware relied on app mimicry, disguised package names, AES-encrypted strings, XOR-encoded data theft, and delayed delivery of core spying functions through downloaded DEX payloads, indicating an actively developed surveillance operation tracked as Andr/Spy-BDD.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On January 10, 2021, the Trading Corporation of Pakistan webpage was replaced with the message 'Hacked by 9bandz.' Sophos also observed that a rotating banner image on the official site had referenced the malicious pmdu.info domain.
Sophos noted that a user named 9bandz advertised 'selling government web shells with full access to directories and files' on a crimeware forum in December. The same alias later appeared in the defacement of a Pakistani government webpage tied to the campaign context.
The pmdu.info domain received a TLS certificate on August 9, according to VirusTotal-linked infrastructure details cited by Sophos. This supported the operation of the spoofed download site used in the spyware campaign.
Sophos reported that the pmdu.info domain used to host a fake Pakistan Citizen Portal page was first registered in early August of that year. The site later served a malicious APK masquerading as the official app.
SophosLabs disclosed a cluster of Trojanized Android apps aimed primarily at users in Pakistan, including fake versions of Pakistan Citizen Portal, Pakistan Salat Time, Mobile Packages Pakistan, Registered SIMs Checker, TPL Insurance, and Pakistan Chat. The company published technical analysis and indicators of compromise, and said the spyware was under active development.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **VajraSpy** Android remote access trojan was used in a cyberespionage campaign attributed to the Patchwork APT group, also tracked as **APT-Q-43/VajraEleph**, with victims primarily in Pakistan. The malware was embedded in at least 12 trojanized Android applications, including six that were available on **Google Play** and amassed more than 1,400 installs before removal, while others were distributed outside the store. Most of the apps impersonated messaging platforms, including a fake chat app called **"Crazy Talk"**, and investigators said the operation likely relied in part on honey-trap romance lures to reach targets such as Pakistani military personnel and other users of interest.
Jun 29, 2026
ESET reported that an Android espionage operation dubbed **eXotic Visit** distributed trojanized but working mobile apps—primarily fake messaging services—to deliver the custom **XploitSPY** malware. The campaign was active from at least late 2021 through the end of 2023 and spread through dedicated websites, GitHub, alternative app stores, and **Google Play**. Researchers said the activity appears to have mainly targeted users in **Pakistan** and **India**, and they track the operators as **Virtual Invaders** without a confirmed link to any previously known threat group. The malware gave operators broad surveillance and remote-control access, including theft of contacts, SMS messages, call logs, files, location data, notifications, audio recordings, and photos. ESET said later variants improved stealth with obfuscation, emulator detection, Firebase-based command-and-control retrieval, and native libraries used to conceal C2 details. The company identified about **380 compromised accounts** across some of the malicious apps and reported multiple samples to Google, which removed the affected apps from Google Play.
Aug 14, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026