DoNot APT Expands Arsenal To Spy On VoIP Calls

Cyble Research and Intelligence Labs (CRIL) analyzed Android spyware attributed to the DoNot APT that weaponizes a benign Quran app and fake messaging/utility apps to steal extensive sensitive data (messages, call/VoIP recordings, screenshots, browser history, location, contacts, etc.), uses Firebase Cloud Messaging and hardcoded C2 domains (capsup.buzz, toolgpt.buzz) for control and payload delivery, and includes hashes and IOC details for detection.