News and Analysis

Cybersecurity researchers have uncovered a scheme involving fraudulent websites hosted on new domains that deliver a notorious Android malware, SpyNote. The illegitimate sites imitate Google Play Store pages to trick users into downloading the malware. This technique is attributed to a threat actor known as GoldFactory, and the malware, which can extract sensitive data, has been adopted by state-sponsored hacking groups. Research also suggests similar tactics are used to target the Uyghur, Taiwanese, and Tibetan communities.