A coalition of governments has released information regarding a series of Android apps that appear legitimate but are, in fact, spyware. These malicious applications were used to target civil society groups that might challenge China’s state interests.
On Tuesday, the U.K.’s National Cyber Security Centre (NCSC), part of the intelligence agency GCHQ, collaborated with agencies from Australia, Canada, Germany, New Zealand, and the United States to publish advisories on two spyware families known as BadBazaar and Moonshine. These spyware variants concealed themselves within seemingly harmless apps, functioning like “Trojan” malware.
They possess surveillance capabilities that allow them to access various features of the phone, including the camera, microphone, chats, photos, and location data, as noted by the NCSC in a Wednesday press release. The NCSC has indicated that BadBazaar and Moonshine were utilized to target specific communities, including Uyghurs, Tibetans, and Taiwanese, as well as civil society organizations.
Uyghurs, a Muslim minority predominantly located in China, have faced severe discrimination, surveillance, and detention by the Chinese government in recent years. This group has frequently been a target of hacking campaigns.
The NCSC emphasized that these spyware apps are particularly aimed at individuals engaged in discussions or activities deemed threatening to state stability. Those most at risk include advocates for Taiwanese independence, Tibetan rights, Uyghur Muslims, and supporters of democracy movements in Hong Kong and the Falun Gong spiritual movement.
In the advisory, the NCSC outlined a list of over 100 malicious Android apps disguised as prayer apps for Muslims and Buddhists, chat applications like Signal and WhatsApp, along with other well-known software like Adobe Acrobat. An iOS app named TibetOne, which was available on the Apple App Store in 2021, was also mentioned.
Google and Apple have not yet responded to requests for comments regarding this issue.