Arsink Spyware Posing as WhatsApp, YouTube, Instagram, TikTok Hits 143 Countries

Arsink is a widespread Android Remote Access Trojan (RAT) used in a global campaign that impersonates over 50 popular apps (WhatsApp, TikTok, etc.) and lures users via Telegram, Discord, and file-sharing sites; researchers found ~1,216 unique builds and ~45,000 infected devices across 143 countries. Once installed, Arsink runs persistent background services to exfiltrate data and enable remote control — including microphone recording, SMS and photo theft, contacts/call history access, location tracking, forced calls, and destructive wipes — with data sent to many backend channels (Firebase, Telegram bots, Google Drive, etc.).