Iranian hackers expand Android spyware campaign amid Middle East tensions – News

A new report out today from mobile security firm Lookout Inc. warns that the Iranian state-aligned cyberespionage group MuddyWater has further developed its Android surveillanceware known as DCHSpy, deploying it in targeted campaigns amid the recent Israel-Iran conflict.

First documented by Lookout in 2024, DCHSpy is a highly invasive tool designed to collect sensitive data from Android devices, including WhatsApp messages, accounts logged into, contact lists, SMS content, call logs, photos, microphone recordings and location information. The MuddyWater cyber espionage group first emerged in 2019 and is part of Iran’s Ministry of Intelligence and Security.

The latest discovery from Lookout includes four new variants of the malware, indicating active development and new capabilities such as enhanced file exfiltration. The samples emerged roughly one week after Israeli strikes on Iranian nuclear sites in June 2025.

The new DCHSpy variants masquerade as seemingly legitimate virtual private network apps, including “Earth VPN” and “Comodo VPN,” that are likely distributed via Telegram and promoted to Iranian users and dissidents. One of the samples was even disguised with a filename referencing “Starlink,” in a likely attempt to capitalize on the satellite provider’s internet access offerings during government-imposed blackouts in Iran.

According to Lookout, the campaign reflects a broader pattern of political targeting by Iranian advanced persistent threat groups. DCHSpy is linked to infrastructure also used by SandStrike, another Android surveillance tool previously used against Baháʼí practitioners, with both malware families leveraging overlapping command-and-control servers and distribution methods.

DCHSpy itself is modular and receives encryption instructions from its command and control servers before transmitting stolen data to secure FTP destinations.

MuddyWater was the subject of a warning from both the U.K. and the U.S. governments back in 2022, when the group was targeting a range of government and private sector organizations in Asia, Africa, Europe and North America. Forward to 2025 and MuddyWater has expanded its surveillance capabilities across geopolitical flashpoints, targeting domestic dissidents and also defense, telecom, and energy organizations worldwide.

The Lookout report suggests that the latest development adds to a growing body of evidence that Iranian threat actors are investing in custom-built mobile malware frameworks for intelligence gathering. The researchers note that they continue to track 17 mobile malware families linked to at least ten Iranian APTs.

“Lookout will continue to track MuddyWater’s activity and inform our threat intelligence customers of any relevant updates,” concluded the authors of the report, Alemdar Islamoglu and Justin Albrecht.

Image: News/Reve