Spyware Targets South Korean Android Users, Linked To China

**Executive summary:** Cyble Research identified a China-linked Android spyware campaign (distributed via deceptive adult-themed phishing sites) targeting users in South Korea that abuses Accessibility and CallScreeningService to exfiltrate contacts, SMS, call logs, media, screenshots and to block/redirect calls and messages for likely financial fraud; the report includes technical analysis, MITRE ATT&CK mappings, observed C2 infrastructure, multiple malware hashes and distribution URLs, exposed victim records, and recommended mitigations.