Warning: Beware of Android Spyware Disguised as Signal Encryption Plugin and ToTok Pro

Cybersecurity researchers have uncovered two Android spyware campaigns, ProSpy and ToSpy, that impersonate Signal and ToTok to target users in the United Arab Emirates. Slovak company ESET said the malicious apps are distributed via fake websites and social engineering to trick users into downloading them, with both campaigns establishing persistent access and exfiltrating data from compromised devices.

Notably, neither app was available in official stores, and both required manual installation from third‑party sites posing as legitimate services. According to ESET, one ToSpy distribution site mimicked the Samsung Galaxy Store to lure users into downloading a malicious ToTok variant, while the ProSpy campaign has been active since 2024 and was discovered in June 2025.

The campaigns focus on stealing sensitive data such as contacts, messages, files, and device information, and use foreground services and Android AlarmManager techniques to maintain persistence, even prompting users with a redirection to the official download pages. Lukáš Štefanko, an ESET researcher, said the ToTok Pro and ProSpy campaigns reveal deceptive steps designed to persuade users the apps are legitimate. according to ESET