APT36 Ghazwa Spyware - MediaProjection Screen+Audio Surveillance

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects sideloaded Android applications that simultaneously initiate screen capture via the MediaProjection API and audio recording via the RECORD_AUDIO permission. This activity is consistent with surveillance capabilities of the Ghazwa spyware used by the APT36 threat actor.