{"id":1190,"date":"2026-06-05T17:14:20","date_gmt":"2026-06-05T17:14:20","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1190"},"modified":"2026-06-05T17:14:20","modified_gmt":"2026-06-05T17:14:20","slug":"android-spyware-asin-targets-arabic-users-via-fake-news-pdf-and-war-map-apps","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1190","title":{"rendered":"Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Jun 05, 2026<\/span><\/span><span class=\"p-tags\">Spyware \/ Mobile Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEimTj2SdhVr1jj9e2RqrAOW9dIsBmuMZJsqWGt6weL0DOfhwYQF_6Hp5B-sYt6ZZEGQB_YPTOW6Xb2x5JygleEwCp8FQFmKDBIfQlCP1QVLGuVGPboCcbXy8LB0oUDSwA-3w6Vqc9QQFiRAaQKqQ2m2EdPopVIWcp7RHtdXbrd9ucWSfEG4D3h2bu1d9dN3\/s1700-e365\/android-war.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Arabic-speaking users have emerged as the target of a new Android spyware codenamed <b>Asin<\/b>, according to <a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/eset-apt-activity-report-q4-2025-q1-2026\/\">findings<\/a> from ESET.<\/p>\n<p>The Slovakian cybersecurity company said it first detected the malware spread via multiple campaigns in early 2025, with each attack wave making use of distinct websites mimicking utilities, war-related updates, and a government news source:<\/p>\n<ul>\n<li>govlens[.]net, which impersonates a government news source (registered on May 27, 2025)<\/li>\n<li>pdf-reader[.]help, which impersonates a secure PDF editor (registered on May 29, 2025)<\/li>\n<li>live-war-map[.]com, which claims to offer updates on military incidents (registered on January 20, 2025)<\/li>\n<\/ul>\n<p>Two of these websites &#8211; govlens[.]net and live-war-map[.]com &#8211; were also marketed via dedicated accounts on social media platforms like Facebook and Telegram &#8211;<\/p>\n<ul>\n<li>www.facebook[.]com\/GovLens<\/li>\n<li>t[.]me\/liveuamap_ar<\/li>\n<\/ul>\n<p>\u00abEach of these websites distributes a malicious app that combines legitimate functionality with stealthy spyware capabilities,\u00bb ESET said.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/vpn-threat-report-m\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhFlTC7RrRZGiFAgASS0noWSL0qsQGFVp8-Hvuw9yp3X3VKRuTcb5SsPX09wJzrdIM6pu1_5lS4EeZp7Sx4iYBpNJkrGnpr08yyaS1HQ5_5TxaCsP6O0OtHNuOkesn6CbNjao1GPulCJk-uljYMSfMZfBYNrngpe669t7jlRn1FqiEnXhsFD1WVkpaYIVgh\/s728-e100\/ai-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The cybersecurity company noted that the Telegram channel&#8217;s name is likely inspired by Live Universal Awareness Map (<a href=\"https:\/\/liveuamap.com\/\">Liveuamap<\/a>), a legitimate, well-known platform dedicated to mapping ongoing conflicts, human rights issues, natural disasters, and geopolitical events across the world.<\/p>\n<p>Multiple artifacts associated with Asin have since been identified, including one uploaded to VirusTotal from T\u00fcrkiye in October 2025, an APK downloaded from the domain \u00abc-pdf[.]net\u00bb in December 2025 by a user on a Xiaomi Redmi Note 13 Pro device running Android 15, and a third sample masquerading as \u00abSyria Defense Map\u00bb detected on a Xiaomi Redmi Note 13 Pro+ 5G devices running Android 15 in around mid-January 2026.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgD8BmKs-2Un49E_LYl9cUeCN-k3nbFnvWyROUIEjRCnay629YGFD7eCsFvPfmhyphenhyphena1_xFhb_JOTgz3PfII6mKLiYUyyfo0eKZbiNPak9uGT_gosvjvBbjMH7TK8kMF_ZYmzOu7EBvhXsnAK6VrJy34R8hsPngGbVRnCXjiAIZd7y4-AQouKc1ZWug511JhI\/s1700-e365\/android-maps.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgD8BmKs-2Un49E_LYl9cUeCN-k3nbFnvWyROUIEjRCnay629YGFD7eCsFvPfmhyphenhyphena1_xFhb_JOTgz3PfII6mKLiYUyyfo0eKZbiNPak9uGT_gosvjvBbjMH7TK8kMF_ZYmzOu7EBvhXsnAK6VrJy34R8hsPngGbVRnCXjiAIZd7y4-AQouKc1ZWug511JhI\/s1700-e365\/android-maps.jpg\" alt=\"\" border=\"0\" data-original-height=\"435\" data-original-width=\"900\"\/><\/a><\/div>\n<p>In the last case, the APK is said to have been downloaded from a website named \u00absyriadefensemap[.]com.\u00bb It&#8217;s worth noting that the user is required to manually install the app and grant it the necessary permissions for the spyware to realize its goals.<\/p>\n<p>The activity cluster, per ESET, remains unattributed. It&#8217;s also not known what the primary objectives of these campaigns are. However, based on the lures used, it&#8217;s suspected that journalists and OSINT researchers in Arabic-speaking regions may have been the target.<\/p>\n<p>\u00abThree out of the five fraudulent apps we unearthed &#8211; GovLens, WarMap, and Syria Defense Map &#8211; seem primarily intended for people interested in open-source investigation,\u00bb the company said. \u00abIt thus seems possible that this set of activities may have been, at least partially, meant to target Arabic-speaking journalists or OSINT practitioners.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Jun 05, 2026Spyware \/ Mobile Security Arabic-speaking users have emerged as the target of a new Android spyware codenamed Asin, according to findings from ESET. The Slovakian cybersecurity company&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1191,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[281,616,1933,1932,150,1934,1543,1021,1030,78,826,925],"class_list":["post-1190","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-android","tag-apps","tag-arabic","tag-asin","tag-fake","tag-map","tag-news","tag-pdf","tag-spyware","tag-targets","tag-users","tag-war"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1190"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1190\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1191"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}