Android Spyware in the UAE Masquerades as ... Spyware

Hackers are spreading two families of mobile spyware around the UAE by masking them as the ToTok app, a messaging and VoIP service developed by G42, an Abu Dhabi government project supported by Microsoft. The campaigns, named ToSpy and ProSpy (the latter mimicking Signal), have been operating for years, with ToSpy emerging in 2022 and ProSpy in 2024.

Researchers at ESET flagged the campaigns after spotting the counterfeit “Pro” editions of ToTok on phishing sites, where users are prompted to install apps from unknown sources before Google Play Protect can intervene. Once installed, ToSpy and ProSpy request invasive permissions and exfiltrate data such as device information, contacts, SMS histories, and various file types to an attacker‑controlled server, while still allowing the real ToTok or Signal to launch.

Google Play Protect is described as providing protection on Android devices, with additional scanning for apps installed outside the Play Store. 2 October 2025