Evil Bamboo Targets Mobile Devices in Multi-year Campaign
Summary: Volexity attributes long-running, currently active mobile spyware campaigns to a threat actor it tracks as EvilBamboo (formerly Evil Eye), operating in the interest of the Chinese state and targeting Tibetan, Uyghur, and Taiwanese individuals and organizations. The actor distributes at least three Android spyware families - BADBAZAAR, BADSIGNAL, and BADSOLAR - backdoored into legitimate apps, including a fake Whoscall thread on a Taiwanese APK forum with over 100,000 views and a fake Signal site at www.signalplus[.]org, and has shared more than 120 backdoored APKs through a Tibetan-themed Telegram group since November 8, 2020.
Bottom line: Distribution runs through channels your app-store controls never see: a forum thread with 100,000 views, Telegram groups, Reddit personas, and fake sites like allwhatsapp[.]net and flygram[.]org, with a profiling script called JMASK used to fingerprint visitors before likely exploitation code is served.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026