Spyware combing for data 'of use to China' hidden inside religious and
cultural apps

Date:
Wed, 09 Apr 2025 19:03:00 +0000

Description:
Experts warn spyware is being loaded into cultural and religious apps to
gather data.

FULL STORY

The UKs National Cyber Security Center, alongside compatriots in Australia, Canada, Germany, New Zealand and the US, are warning apps loaded with spyware are being used to target Uighur, Tibetan and Taiwanese communities.

The spyware, named BADBAZAAR and MOONSHINE, is likely being used to gather information of use to China on individuals who could pose a threat to Chinas security.

Many of the apps loaded with spyware are designed to mimic religious or cultural applications.

Gathering location, audio and photo data

The apps in question include Audio Quran, a religious app used to target
Uighur communities, and TibetOne which appears at first glance to be an application used to share images, videos, music, and articles celebrating Tibetan culture.

There have been attempts to share the applications through legitimate
channels such as the Google Play Store, but these attempts have largely been unsuccessful thanks to the security controls in place on the Play Store.

As a result, the apps were instead shared on forums frequented by the target communities, and relied on users installing the apps through .apk files.

According to the NCSC report [ PDF ], the apps arent just being used to
target individuals, but are also being used to monitor civil society groups
to track their activities.

The BADBAZAAR and MOONSHINE spyware would be able to access real time
location and gps data, live audio and video capture, files stored on the device, SMS and call logs, and device information, as well as being able to play audio through the device.

The joint statement says, Although BADBAZAAR and MOONSHINE have been observed targeting Uighur, Tibetan and Taiwanese individuals, there are other malware that target other minority groups in China. Citizens from co-sealing nations, in China and abroad, who are perceived to be supporting causes that threaten regime stability are almost certainly under threat from mobile malware such
as BADBAZAAR and MOONSHINE.

The capability to capture location, audio and photo data almost certainly provides the opportunity to inform future surveillance and harassment operations by providing real-time information on the targets activity.

======================================================================
Link to news story: https://www.techradar.com/pro/security/spyware-combing-for-data-of-use-to-chin a-hidden-inside-religious-and-cultural-apps

$$
--- SBBSecho 3.20-Linux
* Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)