New Android Spyware Targeting Users by Imitating Signal and ToTok Apps

ESET researchers have uncovered two sophisticated Android spyware campaigns that target users seeking secure communication platforms by impersonating popular messaging apps Signal and ToTok.

These malicious operations appear to focus primarily on residents of the United Arab Emirates (UAE), utilizing deceptive websites and social engineering tactics to distribute previously undocumented malware families.

The investigation revealed two distinct Android spyware families operating through carefully orchestrated deception campaigns. Android/Spy.ProSpy masquerades as upgrades or plugins for both Signal and ToTok messaging applications, while Android/Spy.ToSpy exclusively targets ToTok users by impersonating the app itself.

Neither malicious application was available through official app stores, requiring victims to manually install the software from third-party websites designed to appear legitimate.

The plugin was distributed via phishing using two dedicated websites (https://signal.ct[.]ws and https://encryption-plug-in-signal.com-ae[.]net/), and it was available only in the form of an Android app that required users to enable manual installation from unknown sources.

One particularly sophisticated distribution method involved a fake website mimicking the Samsung Galaxy Store, which successfully lured users into downloading and installing a malicious version of the ToTok app.

ProSpy Campaign

The ProSpy campaign, discovered in June 2025 but believed to have been active since 2024, distributes malware through three deceptive websites impersonating Signal and ToTok platforms.

The campaign offers malicious APK files disguised as improvements, specifically marketed as “Signal Encryption Plugin” and “ToTok Pro”.

The Signal Encryption Plugin variant was distributed through dedicated phishing websites using domains that included “.ae.net” in their structure, suggesting a deliberate focus on UAE residents.

Upon installation, the malicious app requests extensive permissions to access contacts, SMS messages, and device files before beginning background data exfiltration.

After the initial setup, the Signal Encryption Plugin employs a sophisticated disguise technique, changing its appearance on the device to look like “Play Services” and redirecting users to legitimate Google Play Services when clicked.

This activity-alias manipulation effectively masks the spyware’s presence while maintaining persistent access to sensitive data.

ToSpy Campaign

The ToSpy campaign demonstrates even more targeted regional operations, with confirmed detections originating from devices located in the UAE.

Researchers identified six samples sharing identical malicious code and developer certificates, indicating coordination by a single threat actor.

Evidence suggests the ToSpy campaign began in mid-2022, with the developer certificate created on May 24, 2022, and related domains registered around the same timeframe. Several command and control servers remain active, indicating ongoing operations at the time of publication.

The malware specifically targets ToTok backup files with the .ttkmbackup extension, demonstrating particular interest in extracting chat history and app data. This focus aligns with ToTok’s regional popularity in the UAE and surrounding areas.

Both spyware families demonstrate extensive data collection capabilities, systematically exfiltrating device information, stored SMS messages, contact lists, and files across multiple categories including documents, images, videos, and archives.

The malware maintains persistent background operations through foreground services, alarm managers, and boot persistence mechanisms.

ToSpy employs AES encryption in CBC mode with a hardcoded key to secure exfiltrated data before transmission to command and control servers via HTTPS POST requests.

The same encryption key is used across all six identified samples, suggesting centralized development and deployment.

Protection and Prevention Measures

Google Play Protect automatically defends Android users against known versions of this spyware, providing default protection for devices with Google Play Services.

ESET shared their findings with Google as part of the App Defense Alliance partnership, ensuring rapid response to these emerging threats.

Security experts emphasize the importance of avoiding app installations from unofficial sources and disabling the “unknown sources” installation option.

Users should exercise particular caution when downloading apps or add-ons claiming to enhance trusted communication services, especially when prompted to install software outside official app stores.

The discovery of these campaigns highlights the evolving sophistication of mobile spyware operations and the importance of maintaining vigilance when downloading communication applications, particularly in regions where certain apps may be restricted or unavailable through official channels.

IoCs

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.