New Android Spyware Targeting Users by Imitating Signal and ToTok Apps

According to ESET researchers, two sophisticated Android spyware campaigns target users seeking secure communication by impersonating Signal and ToTok, with the operations focused mainly on UAE residents.

The campaigns—ProSpy, which began activity in 2024 and was discovered in June 2025, and ToSpy, detected in devices located in the UAE—use three deceptive websites to distribute malicious APKs disguised as upgrades such as “Signal Encryption Plugin” and “ToTok Pro.” The Android/Spy[.]ProSp family masquerades as Signal and ToTok plugins, while Android/Spy[.]ToSpy impersonates the ToTok app, and neither appears in official app stores.

Once installed, the malware requests extensive permissions and exfiltrates data, including contacts, SMS messages, and files; ToSpy targets ToTok backup files (.ttkmbackup) to extract chat history and app data. Evidence suggests coordinated development, with six samples sharing identical code and certificates, and ToSpy operations dating back to mid-2022, around May 24, 2022, with active command and control servers noted at publication.

Security measures include Google Play Protect and awareness against unknown sources, given the campaigns’ use of fake websites and device‑alias masking techniques.