Asin Android Spyware: Arabic-Language Fake News and War Map Apps Targeting Journalists

Asin was not a single-incident deployment. ESET identified at least three distinct waves, each using a different fake application and distribution domain. The consistent targeting of conflict-related and journalist-relevant tools across all waves points to a deliberate, operationally focused surveillance campaign rather than opportunistic malware distribution.

• 1Wave 1 — January 20, 2025: Domain live-war-map[.]com registered, distributing a fake war-map tracking application. The domain name directly mimics Liveuamap, a legitimate and well-known platform used by journalists and OSINT researchers to track global conflicts, human rights incidents, and geopolitical events. A Telegram channel associated with this wave further mimics the Liveuamap branding.
• 2Wave 2 — May 27–29, 2025: Two new domains registered in rapid succession: govlens[.]net (registered May 27) impersonating a government news aggregation service, and pdf-reader[.]help (registered May 29) impersonating a secure PDF editor. Both deliver Asin-infected APKs that include functional app decoy components to avoid immediate detection.
• 3Wave 3 — October–January 2025–2026: An Asin APK sample uploaded to VirusTotal from Türkiye in October 2025. A second sample distributed from domain c-pdf[.]net detected in December 2025 on a Xiaomi Redmi Note 13 Pro (Android 15). A third sample — Syria Defense Map — detected on a Xiaomi Redmi Note 13 Pro+ 5G (Android 15) in mid-January 2026.
• 4June 5, 2026: ESET publishes public disclosure. Campaign attributed to an unidentified threat actor. Primary attribution unknown — ESET lists Asin among "noteworthy campaigns from lesser-known and unattributed clusters" in their Q4 2025–Q1 2026 APT Activity Report.

Each delivery domain hosts a convincing fake website distributing an APK. The actor invested in domain names and site design that would pass a casual legitimacy check from a target who already expects to find such an application. None of these applications were distributed via Google Play — all require sideloading.

• 1Functional decoy apps: Each infected APK embeds a legitimate functional component — the app actually displays news, renders PDFs, or shows map data. This delays detection by ensuring the target does not immediately notice malicious behavior and uninstall.
• 2Manual sideload required: Victims are directed to enable "Install from Unknown Sources" on their Android devices. The social engineering context — believing they are installing a specialized conflict-tracking or press tool — makes this less suspicious than it would otherwise be.
• 3Permission escalation post-install: After installation, Asin requests the permissions it needs for full surveillance capabilities. The permission requests are presented in the context of the legitimate app functionality (e.g., location access "for the map feature," contacts access "for source management").
• 4Telegram as secondary distribution: A Telegram channel associated with the WarMap campaign pushed links to the APK directly to potential targets. This channel mimicked the naming convention of the legitimate Liveuamap service's Telegram presence.

Asin is a fully featured surveillance-grade spyware, not a commodity infostealer. Its capability set maps to the needs of an operator collecting intelligence on a human target — contact networks, communications, location, and real-time audio/visual access — rather than financial credential theft.

ESET's analysis of the lure selection strongly suggests the targeting is deliberate and operationally motivated rather than opportunistic. Three of five fake applications are tools that would only be sought by someone actively monitoring conflicts, tracking government activities, or investigating regional events.

• 1Türkiye (October 2025): APK sample uploaded to VirusTotal from a Turkish IP address — consistent with either a Turkish user being targeted or a Turkish-based researcher analyzing the malware.
• 2Saudi Arabia / Arabic-speaking region (December 2025 – January 2026): Devices confirmed infected include Xiaomi Redmi Note 13 Pro and Pro+ 5G running Android 15. The specific device models are consistent with usage patterns in the Middle East and North Africa region.
• 3Unattributed threat actor: ESET has not publicly attributed this campaign to a known state-sponsored group or cybercrime operator. The targeting profile — journalists and OSINT researchers in Arabic-speaking regions — is consistent with state-level intelligence interests from multiple regional actors.

When a target device is physically accessible, these checks can confirm or rule out Asin infection without specialist tools. For high-risk individuals (journalists, activists, researchers), any confirmed indicator warrants immediate device isolation and replacement.

• 1Check installed apps for Asin lures: Settings → Apps → See All. Look for any application named GovLens, WarMap, LiveWarMap, Syria Defense Map, C-PDF, or SecurePDF that was not installed from Google Play. If the app icon looks like a news, map, or PDF utility but is not from the official Play Store, treat it as suspicious.
• 2Review app permissions: Settings → Apps → [Suspicious App] → Permissions. An app claiming to be a PDF editor requesting location, microphone, camera, and contacts access has no legitimate reason for those permissions. Any app with this combination is either Asin or comparable spyware.
• 3Check battery and data usage: Settings → Battery → Battery Usage. Background processes running when the app is not open indicate surveillance activity. Settings → Mobile Data → App Data Usage. Unexpected background data from a "PDF editor" or "news app" is a strong indicator of active C2 communication.
• 4Review Unknown Sources installs: Settings → Security → Install Unknown Apps. If any non-standard package installer is shown as having been granted this permission, it was used to sideload an APK. This permission should be disabled immediately after use and reviewed regularly.
• 5Check for associated domains in DNS history: If the device uses a VPN or DNS logging is available, look for outbound connections to govlens[.]net, c-pdf[.]net, live-war-map[.]com, pdf-reader[.]help. Any DNS resolution of these domains confirms the app was downloaded or is actively beaconing.

For devices belonging to at-risk individuals or those suspected of compromise in an organizational context, the Mobile Verification Toolkit (MVT) developed by Amnesty International provides the most thorough Android forensic capability. ADB commands provide a first-pass triage.

If Asin infection is confirmed on a device belonging to a journalist, OSINT researcher, or civil society actor, the response priorities differ from a corporate security incident. Source protection and evidence preservation must be balanced against the personal safety of the device owner.

• 1Do NOT immediately notify sources: If the device has been infected and communications have been monitored, notifying sources via the compromised device may alert the threat actor that detection has occurred. Establish a clean out-of-band communication channel first.
• 2Physical device isolation: Power off the device (do not factory reset immediately — preserve forensic evidence). Remove SIM card. Place in a Faraday bag if available to prevent any remote wipe commands from reaching the device while evidence is preserved.
• 3Forensic acquisition before reset: If the individual consents and the organizational context requires it, perform MVT acquisition before resetting. This evidence may be needed for accountability, legal action, or to identify other targets in the same campaign.
• 4Source notification (clean channel): After establishing a clean device, use Signal on a new number to notify any sources who may have been identified through the compromised device's contacts or communications. Assess whether their safety is at risk.
• 5Replace, don't reset: Factory reset does not guarantee spyware removal on rooted or heavily modified Android devices. For high-risk individuals, device replacement is the recommended remediation. The compromised device should be preserved for forensics, not returned to use.