ESET ProSpy/ToSpy spyware impersonating Signal/ToTok on Android

Security researchers at ESET say they have uncovered two Android spyware campaigns that impersonate Signal and ToTok messaging apps to steal data from users, particularly in the United Arab Emirates. The campaigns, dubbed ProSpy and ToSpy, were detected in June 2025 but show indicators of longer activity, with ProSpy traced to at least 2024 and ToSpy possibly originating in mid 2022, according to the researchers.

ESET found the malicious files were not distributed through official app stores but through fake websites and social engineering that urged users to manually install APK files. One distribution page imitated the Samsung Galaxy Store to make a fake ToTok installation appear legitimate. ProSpy masquerades as a nonexistent Signal Encryption Plugin and as a ToTok Pro upgrade, while ToSpy poses directly as the ToTok app.

Once installed, both spyware families request permissions commonly required by messaging apps, including access to contacts, SMS messages, and stored files. If granted, the malware collects and exfiltrates device information, contacts, SMS, chat backups, images, audio, video, documents, and lists of installed apps. ESET reported that exfiltrated data is...