[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyA0i3JAC2Ca5TXvcXEfuVCCAYH0dyo27TpgF8_a1-ZA":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"b259714f-2789-4cc5-8ba0-f8b921c4daae","Fake Bahrain Alert App Deploys Android Surveillance Malware","fake-bahrain-alert-app-deploys-android-surveillance-malware-071bbd","A malicious application delivers four-stage Android spyware via phony Google Play sites, exploiting civilian fear during Iranian missile strikes.","A new Android surveillance malware campaign has been uncovered, masquerading as a legitimate Bahrain government alert application. The malware is distributed through fake Google Play Store websites, designed to exploit user fear during periods of geopolitical tension, such as Iranian missile strikes. The spyware employs a four-stage infection process to exfiltrate sensitive data from compromised devices.","Fake Bahrain alert app deploys Android surveillance malware via phony Google Play sites.","https:\u002F\u002Fwww.darkreading.com\u002Fmobile-security\u002Ffake-bahrain-alert-apps-android-surveillance-malware","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltbfd2abd92ce58654\u002F6a611f6de7ebfc13d44d6387\u002FBahrain_Manama_Skyline-trabantos-Getty-1140901617.jpg?width=720&quality=80&disable=upscale","2026-07-22T19:42:42+00:00","2026-07-22T22:00:15.306523+00:00",7,[17,20,23],{"name":18,"type":19},"unknown","threat_actor",{"name":21,"type":22},"Bahrain alert app campaign","campaign",{"name":24,"type":25},"Android","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":30,"value":46,"context":47},"Android spyware","Four-stage surveillance malware deployed via fake app",[24],{"controls":50,"vendors":135},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":81,"name":82,"problem":83,"products":84},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"slug":110,"name":111,"problem":112,"products":113},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[114,122,128],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":124,"url":126,"description":127},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":110,"product_name":132,"url":133,"description":134},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":149},"fake-government-app-delivers-android-spyware-via-phishing-sites","Fake Government App Delivers Android Spyware via Phishing Sites","Threat actors exploited public fear during geopolitical tensions by distributing a convincing fake Bahrain government alert app through counterfeit Google Play Store websites. Users who downloaded the app unknowingly initiated a four-stage infection chain that silently exfiltrated sensitive personal data from their devices. This attack highlights how social engineering combined with impersonation of trusted authorities dramatically lowers a victim's guard. The use of fake app store pages also circumvents official vetting processes, making supply chain trust verification critical. When users cannot distinguish legitimate government apps from malicious impostors, the consequences range from personal data theft to potential state-level surveillance.",[141,142,143,144,145,146,147,148],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","NIST SP 800-163: Vetting the Security of Mobile Applications","NIST PR.AT-1: Security Awareness Training","GDPR Article 32: Security of Processing (protection of personal data on devices)","NIST SI-3: Malicious Code Protection","ISO\u002FIEC 27001 A.8.1: Responsibility for Assets",{}]