Full Report
ESET researchers have discovered campaigns distributing spyware disguised as Android Signal and ToTok apps, targeting users in the United Arab Emirates
Analysis Summary
# Threat Actor: Undisclosed Threat Actor (Associated with Android/Spy.ProSpy and Android/Spy.ToSpy)
## Attribution & Identity
The threat actor behind these campaigns remains unnamed in the provided context. The activity is characterized by the deployment of two previously undocumented spyware families: **Android/Spy.ProSpy** and **Android/Spy.ToSpy**.
## Activity Summary
ESET researchers identified two distinct but related spyware distribution campaigns targeting Android users interested in secure communication apps.
* **ProSpy Campaign:** Discovered in June 2025, believed to be ongoing since 2024. This spyware impersonates upgrades or plugins for Signal and ToTok (specifically "Signal Encryption Plugin" and "ToTok Pro"). It was distributed via deceptive websites.
* **ToSpy Campaign:** This campaign distributes spyware impersonating the ToTok messaging app (as a malicious "ToTok Pro" version) and targets ToTok data backups (.ttkmbackup files). One distribution site mimicked the Samsung Galaxy Store. These campaigns are noted as ongoing at the time of publication, with Command & Control (C2) infrastructure remaining active.
## Tactics, Techniques & Procedures
The TTPs are detailed below, mapping to the MITRE ATT&CK framework:
- **Initial Access:** Phishing using dedicated websites impersonating legitimate services (T1660).
- **Execution:** Using **AlarmManager** to restart the foreground service (T1603 - Scheduled Task/Job).
- **Persistence:** Achieving persistence via **BOOT\_COMPLETED** broadcast intent activation at device startup (T1398) and using foreground persistence to keep the service running (T1541).
- **Discovery:** File and Directory Discovery on external storage (T1420). Software Discovery (obtaining a list of installed apps) via ProSpy (T1418). System Information Discovery (device model, ID, etc.) via ProSpy (T1426).
- **Collection:** Exfiltrating various data types including documents, media, files, contacts (T1636.003), and SMS messages (T1636.004 via ProSpy). Specifically targeting **ToTok chat history/data backups (.ttkmbackup)** via ToSpy.
- **Command and Control:** Encrypting exfiltrated data using **AES encryption** (T1521.001 - Symmetric Cryptography).
- **Exfiltration:** Exfiltrating collected data over the C2 channel using HTTPS (T1646).
## Targeting
- **Sectors:** Users and individuals interested in secure communication applications (Signal, ToTok).
- **Geography:** Targeted residents of the **United Arab Emirates (UAE)**. This is suggested by domain naming conventions (e.g., ending in `ae.net`) and the focus on ToTok, an app popular in the UAE.
- **Victims:** Privacy-conscious Android users in the UAE. No specific organizational victims were named.
## Tools & Infrastructure
- **Malware families used:**
* **Android/Spy.ProSpy** (impersonates Signal Encryption Plugin or ToTok Pro).
* **Android/Spy.ToSpy** (impersonates ToTok or ToTok Pro).
- **Infrastructure (C2, domains, IPs):**
* Fake Signal Encryption Plugin distribution: `https://signal.ct[.]ws`, `https://encryption-plug-in-signal.com-ae[.]net/`
* Fake ToTok Pro distribution: `https://totok-pro[.]io/totok_pro_release_v2_8_8_10330.apk`
* C&C servers remain active at the time of analysis.
## Implications
This actor employs targeted social engineering, leveraging the popularity and privacy concerns surrounding applications like Signal and ToTok, to deploy sophisticated spyware designed for deep persistence and data harvesting on Android devices. The specific targeting of ToTok backup files suggests an aim to compromise long-term communication history in this region. The use of fake app stores (mimicking Samsung Galaxy Store) indicates a focus on high trust avenues for initial access.
## Mitigations
- Users should exercise extreme caution regarding installing applications from third-party websites, even if they purport to be updates or plugins for popular apps.
- Users should only download apps from official, verified sources (Google Play Store, Samsung Galaxy Store).
- Ensure **Google Play Protect** is active, as it is capable of automatically protecting against known versions of this spyware.
- Disable the ability to install apps from "Unknown Sources" on Android devices unless absolutely necessary for legitimate purposes.