APT36 Ghazwa ADSFEAM Audio Capture via RECORD_AUDIO in Foreground Service

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

This rule detects suspicious audio capture activity associated with the APT36 Ghazwa spyware. It monitors for the execution of specific foreground services (MEATIER or ADSFEAM) from the package 'com.ghazwa.updates' simultaneously with the application requesting 'RECORD_AUDIO' permissions on the same device.