APT36 Ghazwa Spyware - Sideloaded APK Requesting Device Admin via ADD_DEVICE_ADMIN

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects the installation and execution of known APT36 Ghazwa spyware variants (com.ghazwa.updates, com.chragall, or com.chagall) that are sideloaded (not from the official Google Play Store) and attempt to request or activate Device Administrator privileges via intent actions or receiver class activation.