Iran-Linked DCHSpy Android Malware Masquerades as VPN Apps to Spy on Dissidents
Researchers studying cybersecurity have discovered new Android spyware artifacts that are probably connected to the Iranian Ministry of Intelligence and Security (MOIS). These artifacts were disseminated to targets by posing as VPN applications and SpaceX's Starlink satellite internet connection service.
One week after the Israel-Iran crisis began last month, mobile security vendor Lookout reported finding four copies of a surveillanceware application it identifies as DCHSpy. It's unclear how many users may have installed these apps.
According to security researchers Alemdar Islamoglu and Justin Albrecht, DCHSpy can capture audio and snap pictures in addition to gathering WhatsApp data, accounts, contacts, SMS, files, location, and call logs.
DCHSpy was first discovered in July 2...