Arid Viper disguising mobile spyware as updates for non-malicious Android applications

• Since April 2022, Cisco Talos has been tracking a malicious campaign operated by the espionage-motivated Arid Viper advanced persistent threat (APT) group targeting Arabic-speaking Android users. In this campaign, the actors leverage custom mobile malware, also known as Android Package files (APKs), to collect sensitive information from targets and deploy additional malware onto infected devices.


• Although Arid Viper is believed to be based out of Gaza, Cisco Talos has no evidence indicating or refuting that this campaign is related in …

advanced advanced persistent threat android android users applications april apt arid viper campaign cisco cisco talos collect espionage files information malicious malware mobile mobile malware mobile spyware non package persistent persistent threat sensitive sensitive information speaking spyware talos targeting threat tracking updates