Ankura CTIX FLASH Update - October 3, 2025

Malware Activity

Sophisticated Android Spyware and Trojan Campaigns Targeting Regional and Financial Users

Recent cybersecurity investigations have revealed highly advanced Android malware campaigns, including the spyware families ProSpy and ToSpy. The spyware, which primarily target users in the United Arab Emirates through social engineering and fake websites, impersonates official app platforms such as Signal and ToTok. These malicious apps, which are not available on official app stores, exploit user trust by masquerading as legitimate updates or plugins. Then requesting extensive permissions to exfiltrate sensitive data like contacts, messages, files, and device information. While employing stealth tactics like mimicking legitimate app icons and maintaining persistence through background services and device reboot mechanisms. The malware has been active since at least mid-2022. These campaigns utilize encryption, redirection to legitimate download sites, and