ProSpy, ToSpy malware pose as Signal and ToTok to steal data in UAE

Researchers from ESET uncovered two Android spyware campaigns, ProSpy and ToSpy, that target UAE users by impersonating Signal and ToTok and delivering malicious APKs via fake websites and social engineering. The campaigns are tracked separately due to different delivery methods and infrastructure, and neither spyware was found in official app stores; manual installation from third‑party sites posing as legitimate services is required.

ProSpy has been active since 2024 and was discovered in June 2025, while ToSpy was first detected in June 2025, with both collecting and exfiltrating data such as contacts, SMS, files and other device information. The malware disguises itself as dubious upgrades or plugins and relies on persistent background services, AlarmManager for auto‑restart, and boot‑completed registration to maintain presence.

The campaigns appear to primarily target UAE users, with follow‑throughs including misdirection to fake app stores such as a Galaxy Store clone and other phishing domains still online at the time of analysis. According to ESET, the researchers noted that one ToTok variant could redirect users to official sources if the genuine ToTok app is missing, underscoring the operators’ emphasis on stealth and persistence.