Esperts found new DoNot Team APT group’s Android malware

CYFIRMA researchers linked a new Android malware family named "Tanzeem" to the Indian APT group DoNot Team (APT‑C‑35/Origami Elephant). The malicious app masquerades as a chat client, requests Accessibility permissions, can exfiltrate call logs, contacts, SMS, precise location, account information and external files, and record the screen; operators leveraged the OneSignal platform to push phishing links and install persistent malware on targeted South Asian government, military and diplomatic organizations. The report notes minor variant UI differences, documents an evolution in tactics (OneSignal abuse), and includes IoCs.