Android spyware campaigns impersonate Signal and ToTok messengers

ESET researchers identified two Android spyware campaigns — ProSpy and ToSpy — that impersonate Signal and ToTok to trick users into installing malicious APKs which request permissions and exfiltrate contacts, SMS, media, ToTok backups and device information; both families implement persistence (AlarmManager restarts, foreground services, BOOT_COMPLETED) and use active C2 infrastructure and encrypted exfiltration, with IoCs published but attribution unresolved.