Bitter APT group using “Dracarys” Android Spyware

Cyble Research Labs identified the Bitter APT distributing Dracarys Android spyware by trojanizing legitimate messaging apps (e.g., Signal) via phishing sites; the malware abuses accessibility/device admin and requests sensitive permissions, communicates with a Firebase-based C2, and exfiltrates contacts, SMS, call logs, files, audio, and screenshots—the report includes APK hashes, malicious URLs, MITRE ATT&CK mappings, and recommended mitigations.