Unlucky Kamran: Android malware spying on Urdu-speaking residents of Gilgit-Baltistan

ESET researchers discovered Kamran, a previously undocumented Android spyware distributed via a likely watering‑hole on the Hunza News website targeting Urdu‑speaking users in Gilgit‑Baltistan; the APK (com.kamran.hunzanews) requests broad permissions, harvests contacts, SMS, call logs, calendar entries, images, location, and device info, and exfiltrates data to a hardcoded Firebase C2. The app was hosted on the news site from at least early 2023, required sideloading from unknown sources, compromised at least 20–22 mobile devices, and lacks remote command capabilities or background exfiltration.