Android spyware camouflaged as VPN, chat apps on Google Play – June 2023

Three Android apps on Google Play were used by state-sponsored threat actors to collect intelligence from targeted devices, such as location data and contact lists.
The malicious Android apps were discovered by Cyfirma, who attributed the operation with medium confidence to the Indian hacking group "DoNot," also tracked as APT-C-35, which has targeted high-profile organizations in Southeast Asia since at least 2018.
In 2021, an Amnesty International report linked the threat group to an Indian cybersecurity firm and highlighted a spyware distribution campaign that also relied on a fake chat app.

Togo: Hackers-for-hire in West Africa: Activist in Togo attacked with Indian-made spyware - Amnesty International – 2021

DoNot APT Elevates its Tactics by Deploying Malicious Android Apps on Google Play Store - CYFIRMA – 2023

#DoNot #APT #India #Africa #Togo #spyware #GooglePlay