ProSpy

ProSpy is an Android spyware family, detected by ESET as Android/Spy.ProSpy, that has been active since at least 2024 and was discovered in June 2025. It was distributed outside official app stores via fake websites and phishing pages, primarily targeting users in the United Arab Emirates. ProSpy impersonated a nonexistent Signal Encryption Plugin and a fake ToTok Pro application; reporting also states it masqueraded as other communications apps including WhatsApp, Zoom, and Botim in related campaigns. Known distribution domains mentioned in the reporting include signal.ct[.]ws, encryption-plug-in-signal.com-ae[.]net, and totok-pro[.]io.

Once installed, ProSpy requests access to contacts, SMS messages, and files stored on the device, then exfiltrates sensitive data including device information, public IP address, SMS messages, contact lists, installed applications, and files such as documents, archives, images, audio, and video. Reported local staging filenames include contacts_list.json, device_info.json, and sms_list.json. In broader reporting on associated espionage activity, ProSpy was described as capable of stealing chats, files, media, SMS messages, contacts, and app backups, and in some accounts as providing full device control.

The malware uses persistence mechanisms including foreground services, AlarmManager restarts, and BOOT_COMPLETED receivers. The Signal-themed variant could change its icon and label to Play Services using Android activity-alias functionality, launch the legitimate Signal app, or redirect users to signal.org if Signal was not installed. The fake ToTok Pro variant redirected users to the official ToTok download page and later launched the real ToTok app to reduce suspicion.

Multiple reports link ProSpy to espionage targeting journalists, activists, opposition figures, and some government-linked individuals across the Middle East and North Africa, with confirmed or likely targeting in the UAE and reporting also naming Egypt, Lebanon, and Bahrain. Lookout attributed malware used in this broader campaign to the South Asian threat group BITTER, also known as T-APT-17 and APT-Q-37, citing code similarities between ProSpy and the earlier Dracarys malware, though ESET stated attribution for the ProSpy campaign itself remained unknown. Researchers assessed the activity as surveillance-oriented and possibly hack-for-hire. CISA later highlighted ProSpy among spyware campaigns abusing trust in messaging applications to target high-value individuals.