New Android spyware found on phone seized by Russian FSB

Citizen Lab forensic analysis found that a Russian programmer's phone, returned after detention by the FSB, had been implanted with advanced spyware that impersonated a legitimate Android call‑recorder app. The Monokle-like malware grants broad permissions (location, SMS/contacts/calendar access, call/screen/video recording, keylogging, file and password exfiltration, remote command execution and APK installation), uses a two-stage encrypted architecture, and shows indicators of reuse or evolution of Monokle code with potential iOS targeting—consistent with state-sponsored surveillance operations.