Rapid Response: Zimperium Detects GhostSpy Android RAT

CYFIRMA uncovered GhostSpy, a highly stealthy and persistent web-based Android Remote Access Trojan that can remotely control infected devices, exfiltrate sensitive information, monitor activity in real time, and resist uninstallation by hiding in seemingly benign apps. Zimperium reports on-device dynamic detections of GhostSpy IOCs — including an instance on an Honor Magic V3 in Singapore (Android 14) impacting a banking app in November 2024 — indicating active in-the-wild presence and targeted risk to mobile users and organizations.