Fake Bahrain Alert App Deploys Android Surveillance Malware

Researchers reported an active campaign distributing a malicious Android app, "BH Alert," masquerading as a Bahraini emergency-alert application via cloned Play Store and government sites; the four-stage payload deploys OctagonPanel and Ward frameworks to perform persistent surveillance, SMS and credential theft, banking-app overlays, screenshots, and remote control, with potential to bypass MFA and affect corporate access. Defenders are advised to use MDM to block sideloads and network monitoring to detect a distinctive ~5-second C2 heartbeat.