The KGB’s All-Seeing Eye: How ResidentBat Spyware Turns Seized Phones into Total Surveillance Tools

According to RESIDENT[.]NGO and RSF Digital Security Lab, a new spyware family called ResidentBat has been used by the Belarusian KGB to turn journalists’ and activists’ smartphones into 24/7 surveillance devices. Unlike high-end zero-click exploits, this campaign relies on the physical seizure of devices during police interrogations, with the investigation beginning in the third quarter of 2025 after a journalist was summoned for questioning.

The malware is bundled as a standard Android app but asks for 38 permissions, including access to SMS, calls, camera, and microphone, and it leverages Android’s Accessibility Service to read screen content from encrypted messengers such as Signal, Telegram and WhatsApp. It can capture the screen, log keystrokes, and access the clipboard, and it registers as a Device Admin to run in the background and even wipe data remotely if discovered.

The operation is alleged to have been active since at least March 2021, and while antivirus tools may help, the report notes that high-risk individuals should consider alphanumeric passwords and security-focused operating systems as a safeguard.