Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps
ESET says a new Android spyware campaign called Asin is targeting Arabic-speaking users through fake news, PDF, and war-map apps.
Intelligence analysis by GPT-5.4 Mini
ESET says Asin has been spread since early 2025 through multiple websites that imitate a government news source, a PDF editor, and a war-update map. The lure suggests the campaign may be aimed at Arabic-speaking journalists and OSINT practitioners.
A sneaky app pretends to be a news site, a PDF tool, or a war map, but it also spies on the phone. It is like getting a toy that also has a hidden camera inside it.
Analysis
What ESET found
ESET says it identified a new Android spyware cluster called Asin that has been used in campaigns aimed at Arabic-speaking users. The activity first appeared in early 2025 and relied on multiple websites that pretended to offer useful or timely services.
The sites included govlens[.]net, which mimicked a government news source; pdf-reader[.]help, which posed as a secure PDF editor; and live-war-map[.]com, which claimed to provide updates on military incidents. ESET also said two of the sites were promoted through social accounts on Facebook and Telegram.
How the malware is delivered
According to ESET, each site distributed a malicious Android app that combined legitimate-looking functionality with spyware behavior. The company said the user has to manually install the app and grant permissions before the spyware can achieve its goals.
ESET also said it found several related artifacts: one sample uploaded to VirusTotal from Türkiye in October 2025, another APK downloaded in December 2025 from c-pdf[.]net on a Xiaomi Redmi Note 13 Pro running Android 15, and a third sample disguised as Syria Defense Map on a Xiaomi Redmi Note 13 Pro+ 5G in mid-January 2026.
Likely target audience
The cluster remains unattributed, and ESET said it does not know the primary objective of the campaigns. Still, the lures give a strong clue: three of the five fake apps - GovLens, WarMap, and Syria Defense Map - appear designed for people interested in open-source investigation. ESET said this makes it possible the campaigns were meant, at least in part, for Arabic-speaking journalists or OSINT practitioners.
Key points
- ESET says a new Android spyware cluster called Asin is targeting Arabic-speaking users.
- The campaign used fake sites pretending to be a government news source, a PDF editor, and a war map service.
- Some of the sites were promoted through Facebook and Telegram accounts.
- The malicious apps require manual installation and permission grants from the user.
- ESET suspects the campaign may be aimed at Arabic-speaking journalists or OSINT practitioners.
If the findings spread quickly, users in Arabic-speaking communities may avoid the fake apps and websites before more phones are infected. Security teams and researchers can also use the names, domains, and sample details to spot similar scams sooner.
If the campaign continues, more people could install the fake apps and hand over permissions that let the spyware work. The targeted lures may be especially effective against journalists and OSINT users who expect these tools to be useful and trustworthy.
