Executive Summary
A sophisticated variant of the Ghazwa spyware, attributed to the APT36 threat actor, has been identified targeting Android platforms. Disguised as a "Security Update," this malware employs a wide array of surveillance capabilities, including real-time GPS tracking, screen recording via Android's MediaProjection API, and audio capture. The malware systematically requests elevated device administrator privileges to ensure persistence and prevent uninstallation.
Technical analysis reveals an advanced configuration hub (SEITING class) that manages command-and-control (C2) communication and toggles various spying features. The malware exfiltrates sensitive user data including SMS history, call logs, contacts, and specific file types. Its use of obfuscated class names like MEATIER and APRACTIV, combined with foreground service persistence, indicates a mature development cycle aimed at long-term intelligence collection.
This threat is critical for organizations with mobile workforces as it provides attackers with full visibility into the victim's digital life. The malware's ability to record screens and capture credentials via password monitoring highlights a significant risk to corporate account security.