Commercial Spyware: How It Infects Mobile Devices and What It Can Expose
Summary
An overview of commercial spyware describes how tools infect mobile devices, steal data, and evade detection, with examples including Crocodilus and Landfall. It also outlines warning signs and steps organizations can take to reduce risk.
Key points
- Commercial spyware can collect communications, credentials, contacts, files, and location data, sometimes without user interaction.
- Crocodilus uses Android Accessibility Services to monitor activity, steal banking credentials and wallet seed phrases, and intercept one-time passcodes.
- BTMOB RAT offers operators remote access capabilities and can use an infected device’s contacts to spread phishing messages.
- The article says Landfall infected Samsung Galaxy devices through malformed image files and remained undetected for close to a year before the flaw was patched.
- Possible signs of infection include unusual battery drain or data use, overheating, sluggish performance, unfamiliar profiles, and unrecognized apps.
- Recommended defenses include keeping operating systems updated, preventing sideloading, reviewing app permissions, training users, and examining at-risk devices for indicators of compromise.
- For high-risk iOS users, the article recommends considering Lockdown Mode while a suspected device is being analyzed.
Article Details
- Topic
- Commercial spyware targeting mobile devices, including consumer-grade stalkerware and banking trojans, mobile remote-access malware, and mercenary spyware used for surveillance.
Malware
BTMOBBTMOB RAT represents a shift in how mobile malware is distributed and used. Rather than being deployed by a single threat actor, it operates as a fully commercialized malware-as-a-service platform, essentially aCrocodilusCrocodilus is an Android banking trojan first discovered in March 2025 that has quickly grown into one of the more technically sophisticated consumer threats on the mobile landscape. Once installed — typically throughGraphiteGraphite is a mercenary spyware platform developed by Paragon and sold to government agencies. Like Pegasus, it is capable of zero-click infection, compromising a device through a maliciously crafted photo or videoLandfallLandfall is commercial-grade Android spyware used in a targeted campaign against Samsung Galaxy devices. It was delivered inside malformed image files sent through a messaging app, exploiting a vulnerability inPegasusPegasus is widely regarded as the most advanced commercial spyware tool in existence. Pegasus is capable of infectingdevices through zero-click exploits, requiring no interaction from the target and gaining access to
Vendors
Jamfof its documented attack vectors is the exploitation of WhatsApp, which is used to silently target users. Jamf Threat Labs has analyzed Pegasus-infected devices first-hand, documenting indicators of compromise on theParagonGraphite is a mercenary spyware platform developed by Paragon and sold to government agencies. Like Pegasus, it is capable of zero-click infection, compromising a device through a maliciously crafted photo or video
Products
AndroidMalwarebytes recorded a 147% increase in Android spyware detections in the first half of 2025, and its use has expanded with private intelligence contractors, corporate espionage operations targeting executives and R&DCocospySpyzie, Cocospy and SpyicFlexiSPYFlexiSPY is one of the most feature-rich commercial surveillance tools available, compatible with Android, iOS, Windows and macOS. It is designed to be covertly installed on a target device, running in the background toiOSFlexiSPY is one of the most feature-rich commercial surveillance tools available, compatible with Android, iOS, Windows and macOS. It is designed to be covertly installed on a target device, running in the background toJamf Mobile ForensicsScan at-risk devices: Jamf Mobile Forensics detects indicators of compromise, so when a device shows any of the signs above, your team can confirm an infection and respond before more data is exposed.Lockdown ModeConsider Lockdown Mode: While not recommended for standard use, Lockdown Mode on iOS restricts functionality for the sake of security and is best for high-risk users such as executives, legal teams or anyone handlingmSpymSpy is a widely used monitoring tool marketed primarily as a parental control application. It provides access to call logs, SMS, GPS location, email and social media activity. Unlike FlexiSPY, mSpy does not requireSamsung GalaxyLandfall is commercial-grade Android spyware used in a targeted campaign against Samsung Galaxy devices. It was delivered inside malformed image files sent through a messaging app, exploiting a vulnerability inSpyicSpyzie, Cocospy and SpyicSpyzieSpyzie, Cocospy and Spyic