APT36 Ghazwa — Android Spyware Masquerading as Security Update with Device Admin + Surveillance Permission Cluster

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•7

Detects potentially malicious Android applications installed via non-standard sources that exhibit suspicious characteristics such as masquerading as system/security updates, requesting device administrator privileges, or clustering highly sensitive permissions like location, contacts, call logs, and audio recording.