Android Users Beware: New Spyware Masquerades as Signal and ToTok Apps

Cybersecurity researchers have uncovered two sophisticated Android spyware campaigns, ProSpy and ToSpy, that are targeting users in the United Arab Emirates. These malicious applications are cleverly disguised as legitimate apps, specifically impersonating Signal's encryption plugin and ToTok Pro. Distributed through deceptive websites and social engineering tactics, these spyware strains aim to gain persistent access to devices and steal sensitive user data.

Key Takeaways

• Two Android spyware campaigns, ProSpy and ToSpy, have been identified.

• They impersonate Signal Encryption Plugin and ToTok Pro.

• Distribution occurs via fake websites, not official app stores.

• Target users are primarily in the United Arab Emirates.

• Stolen data includes contacts, SMS, files, and device information.

Deceptive Distribution Methods

Both ProSpy and ToSpy were found to be distributed through unofficial channels. Malicious APK files were hosted on fake websites designed to mimic legitimate services. In one instance, a website impersonated the Samsung Galaxy Store, tricking users into downloading a compromised version of the ToTok app. Neither of the spyware-laden applications were available on official app stores like Google Play or the Apple App Store, requiring users to manually install them from third-party sources.

How the Spyware Operates

Once installed, the spyware requests extensive permissions, including access to contacts, SMS messages, and stored files. It is also capable of exfiltrating device information. The ProSpy campaign, active since at least 2024, uses deceptive websites that claim to offer upgrades for Signal and ToTok. The ToSpy campaign, which began around June 2022, also leverages fake ToTok websites. Notably, ToTok itself was previously removed from major app stores due to concerns about its potential to act as a spying tool for the U.A.E. government.

Advanced Evasion Tactics

To further deceive victims, the spyware employs sophisticated tactics. For example, the malicious ToTok Pro app might display a "CONTINUE" button that redirects users to the official ToTok download page, reinforcing the illusion of legitimacy. Subsequent launches of the fake app would then seamlessly open the real ToTok, masking the spyware's presence. However, users might notice two ToTok apps installed on their device. Similarly, the fake Signal Encryption Plugin, after gaining necessary permissions, changes its icon to impersonate Google Play Services. Regardless of the specific app impersonated, the spyware stealthily exfiltrates data before the user interacts with any deceptive buttons.

Persistence and Data Exfiltration

To ensure continuous operation, both spyware families utilize foreground services with persistent notifications and employ Android's AlarmManager to relaunch services if terminated. They also automatically launch necessary background services upon device reboot. The data stolen includes device information, SMS messages, contact lists, files, and chat backups. The exact perpetrators behind these campaigns remain unknown.

As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Key Takeaways

• Beware of Android Spyware Disguised as Signal Encryption Plugin and ToTok Pro, The Hacker News.

• ToTok — Latest News, Reports & Analysis, The Hacker News.