SpyMax Variant Targeting Chinese-Speaking Users
In early 2025, our threat intelligence team analyzed a highly sophisticated Android spyware disguised as the official application of the Chinese Prosecutor’s Office (检察院). What we uncovered was a deeply invasive mobile surveillance tool—an advanced variant of the SpyMax/SpyNote family—targeting Chinese-speaking users across mainland China and Hong Kong.
Unlike typical Android malware, this campaign exploits Android Accessibility Services using polished social engineering techniques and deceptive UI elements. Once granted permissions, the spyware gains near-total control of the device—accessing messages, calls, GPS data, the camera, microphone, and more.
APK Name: 检察院 (Chinese Prosecutor’s Office)
MD5: cc7f1343574f915318148cde93a6dfbc
Detection Date: April 4, 2025
Distribution: Fake official app via third-party stores
The malware’s modular design includes components for:
This spyware requests an alarming set of permissions—ranging from SMS and camera access to silent app installation and system overlay control. Together, these enable:
The most chilling part? The attackers designed a fully interactive HTML interface to impersonate Android’s accessibility settings page—complete with animated buttons and official-looking layouts—to convince users to grant critical permissions.
To detect this variant, we created a dedicated YARA rule and listed all key IOCs, including:
C2 Server: 165.154.110.64
Network behavior: ICMP ping, encrypted transfers Suspicious file paths and component names
More posts
Share this article
Found it interesting? Don’t hesitate to share it to wow your friends or colleagues
Subscribe to our blog newsletter to follow the latest posts
