New Android Spyware Targeting Users by Imitating Signal and ToTok Apps

ESET researchers have recently unveiled two intricate Android spyware campaigns that cleverly disguise themselves as popular messaging applications, Signal and ToTok. These malicious initiatives predominantly target users in the United Arab Emirates (UAE), employing deceptive websites and social engineering tactics to disseminate previously undocumented malware families.

The investigation has identified two separate Android spyware families engaged in these meticulously crafted deception campaigns. The first, Android/Spy.ProSpy, masquerades as upgrades or plugins for both Signal and ToTok messaging applications. In contrast, Android/Spy.ToSpy specifically targets ToTok users by impersonating the app itself.

Notably, neither of these malicious applications was found on official app stores, necessitating that victims manually install the software from third-party websites designed to appear legitimate. The plugin was distributed through phishing tactics via two dedicated websites: signal.ct[.]ws and encryption-plug-in-signal.com-ae[.]net, and was available solely as an Android app requiring users to enable manual installation from unknown sources.

One particularly cunning distribution method involved a counterfeit website that mimicked the Samsung Galaxy Store, successfully enticing users to download and install a malicious version of the ToTok app.

ProSpy Campaign

The ProSpy campaign, which was discovered in June 2025 but is believed to have been active since 2024, disseminates malware through three deceptive websites that impersonate Signal and ToTok platforms. This campaign offers malicious APK files disguised as enhancements, specifically marketed as “Signal Encryption Plugin” and “ToTok Pro.”

The Signal Encryption Plugin variant was distributed through dedicated phishing websites using domains that included “.ae.net,” indicating a targeted focus on UAE residents.

Upon installation, the malicious app requests extensive permissions to access contacts, SMS messages, and device files, initiating background data exfiltration. Following the initial setup, the Signal Encryption Plugin employs a sophisticated disguise technique, altering its appearance on the device to resemble “Play Services” and redirecting users to legitimate Google Play Services when clicked.

This activity-alias manipulation effectively conceals the spyware’s presence while ensuring persistent access to sensitive data.

ToSpy Campaign

The ToSpy campaign exhibits an even more focused regional operation, with confirmed detections originating from devices located in the UAE. Researchers have identified six samples sharing identical malicious code and developer certificates, suggesting coordination by a single threat actor.

Evidence indicates that the ToSpy campaign commenced in mid-2022, with the developer certificate created on May 24, 2022, and related domains registered around the same period. Several command and control servers remain active, signifying ongoing operations at the time of publication.

This malware specifically targets ToTok backup files with the .ttkmbackup extension, highlighting a particular interest in extracting chat histories and app data, which aligns with ToTok’s popularity in the UAE and surrounding regions.

Both spyware families exhibit extensive data collection capabilities, systematically exfiltrating device information, stored SMS messages, contact lists, and files across various categories, including documents, images, videos, and archives. The malware maintains persistent background operations through foreground services, alarm managers, and boot persistence mechanisms.

ToSpy employs AES encryption in CBC mode with a hardcoded key to secure exfiltrated data before transmission to command and control servers via HTTPS POST requests. The same encryption key is utilized across all six identified samples, suggesting centralized development and deployment.

Protection and Prevention Measures

Google Play Protect automatically safeguards Android users against known versions of this spyware, providing default protection for devices with Google Play Services. ESET has shared their findings with Google as part of the App Defense Alliance partnership, ensuring a swift response to these emerging threats.

Security experts stress the importance of avoiding app installations from unofficial sources and disabling the “unknown sources” installation option. Users should exercise particular caution when downloading apps or add-ons that claim to enhance trusted communication services, especially when prompted to install software outside official app stores.

The discovery of these campaigns underscores the evolving sophistication of mobile spyware operations and the critical need for vigilance when downloading communication applications, particularly in regions where certain apps may be restricted or unavailable through official channels.

IoCs

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.