THE article discusses a cyber-espionage campaign by the group Armored Likho, also known as Eagle Werewolf. They deployed the Armored Likho Still Toolkit, which includes tools for stealing Telegram session data and conducting audio surveillance. The campaign utilized fake donation apps that, once downloaded, stealthily collected users' private information and recorded ambient audio without their consent.
Key features of the toolkit include modules called Still Sync for credential harvesting and Still Audio for conversation recording. The threat primarily targets individuals and organizations in Russia and poses significant risks to privacy and security, especially by bypassing two-factor authentication. Security recommendations include monitoring for unusual processes and restricting user permissions to combat this threat.