BouldSpy: A New Android Surveillance Tool

A newly reported Android spyware family called BouldSpy—attributed with moderate confidence to Iran’s Law Enforcement Command (FARAJA)—targets minority groups and possibly individuals involved in trafficking. BouldSpy abuses Android accessibility services, CPU wake locks, and disables battery management to maintain persistence, records calls, captures photos, monitors account usernames, and exfiltrates cached device data to a command-and-control server; 20 samples have been observed and the malware is distributed outside Google Play. Zimperium reports detection of known variants via its on-device machine learning and warns about the risks of sideloading.