Cybersecurity researchers have discovered a spyware campaign that is targeting #Uyghurs by “masquerading” as Android apps including messaging services, prayer time apps and dictionaries, according to a new report by the cloud security firm Lookout. theguardian.com/world/2022/nov…
The spyware, which researchers say is connected to a Chinese government-backed hacking group, can be used to track people who use services that may be considered a “pre-crime” ...
... or are seen by #China as indications that someone is engaging in or will engage in religious extremist or separatist activities.
“Pre-crime” activities include using a virtual private network (VPN) or sharing any kind of religious content and can lead to being detained in a re-education camp.
The surveillance campaign primarily targets Uyghurs in China, according to the report, but there is also evidence that those behind the campaign were looking to target Uyghurs in Muslim-majority countries like Afghanistan or Turkey.
Several Chinese surveillance and camera companies have been placed on the US entity list for complicity in human rights violations.
Some of these firms have filed for patents for, developed or planned to develop features that would allow them to detect or set up alerts when someone who is Uyghur is detected.
Researchers say many of the apps with this spyware, which they have named Badbazaar, collect device data including location; contacts; call logs; wifi information; and can also record phone calls and take pictures.
The researchers also found that newer iterations of Moonshine, an Android exploit first discovered in 2019 by the University of Toronto’s research group Citizen Lab, ...
... implement spyware in popular apps including WhatsApp and Telegram as well as “versions of Muslim cultural apps, Uyghur-language tools, or prayer apps”.
Kristina Balaam, a staff threat intelligence researcher at Lookout, said this was one of the more sophisticated “malware families” they had seen because in addition to collecting extensive data on people, the apps they are either custom-building or infecting are fully functional.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
