ESET Identifies Asin Android Spyware Campaign Targeting Arabic-Speaking Users
Summary
ESET identified Asin, an unattributed Android spyware campaign using fake news, PDF, and war-update apps. The lures suggest possible targeting of Arabic-speaking journalists and OSINT researchers.
Key points
- ESET says it detected Asin spreading through multiple campaigns beginning in early 2025.
- Fraudulent apps posed as GovLens government news, a secure PDF editor, war updates, and Syria Defense Map.
- Distribution sites included govlens[.]net, pdf-reader[.]help, live-war-map[.]com, c-pdf[.]net, and syriadefensemap[.]com.
- Users must manually install the apps and grant permissions for the spyware to operate.
- ESET said the activity remains unattributed and its primary objectives are unknown.
- ESET suspects the lures may have targeted Arabic-speaking journalists or OSINT researchers; this remains unconfirmed.
Article Details
- Event Type
- Android spyware campaign using fake apps and websites to target Arabic-speaking users.
- Impact
- The malicious apps combine legitimate functionality with stealthy spyware capabilities. The specific objectives and resulting impact are unknown; journalists and OSINT researchers in Arabic-speaking regions are suspected targets, and attribution remains unresolved.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | c-pdf[.]net | Domain from which a sample associated with Asin was downloaded. |
| DOMAIN | govlens[.]net | Website impersonating a government news source that distributes a malicious Asin app. |
| DOMAIN | live-war-map[.]com | Website offering war-related updates that distributes a malicious Asin app. |
| DOMAIN | pdf-reader[.]help | Website impersonating a PDF editor and distributing a malicious app. |
| DOMAIN | syriadefensemap[.]com | Website from which the malicious Syria Defense Map app was downloaded. |
Malware
Products
AndroidESET identified a new Android spyware campaign called Asin that targets Arabic-speaking users through fake apps disguised as government news, PDF tools, and war-update services.GovLens#AsinSyria Defense MapGovLens, Live War Map, and Syria Defense Map are among the fraudulent apps.WarMap“Three out of the five fraudulent apps we unearthed – GovLens, WarMap, and Syria Defense Map – seem primarily intended for people interested in open-source investigation,” the company said.