BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actors

This report presents two case studies of targeted mobile spyware campaigns: MOONSHINE, an Android spyware distributed via Telegram and WhatsApp that masquerades as legitimate apps and provides extensive surveillance (real-time location, audio/photo capture, SMS/call logs) accessible via a 'SCOTCH ADMIN' panel; and BADBAZAAR, an iOS/Android malware family distributed through social channels, app stores and a spoofed website (tibetone.org) to target Uyghurs, Tibetans and Taiwanese, including use of fake personas and multiple social accounts to legitimize distribution.