SilentSelfie: Revealing a major campaign against Kurdish websites

This report documents a long-running (since late 2022) watering‑hole campaign targeting Kurdish community websites using four JavaScript variants to harvest geolocation, device/browser fingerprints, local IPs, and selfie images, and in selected cases to push a malicious Android APK that exfiltrates contacts, files and GPS; it includes technical analysis of the APK (LocationHelper service), infrastructure IOCs (domains, IPs, APK hashes), YARA rules, victimology and attribution hypotheses but finds no definitive link to known intrusion sets.