Arid Viper Espionage Group Targets Arabic Android Users

The notorious Arid Viper advanced persistent threat (APT) group, also recognized as APT-C-23, Desert Falcon, and TAG-63, has undertaken a sophisticated spyware campaign. The operation targets Arabic-speaking Android users through a sham dating application, which serves as a front to harvest personal data from unsuspecting victims' devices.

Recent insights from Cisco Talos, a leading threat intelligence group, have traced this activity since April 2022, uncovering that Arid Viper has been exploiting custom malware to infect Android devices. There's currently no direct evidence linking these activities to the Israel-Hamas conflict.

The sophisticated malware employed by Arid Viper exhibits striking similarities to a non-malicious online dating application named "Skipped." Investigations indicate a possible association between the threat actors and Skipped’s development or unauthorized access to its database.

Cisco Talos additionally flagged a web of dating applications linked to Skipped available on mainstream app stores, hinting at an extensive network poised for potential exploitation. Among these apps are "VIVIO - Chat, flirt & Dating," "Meeted - Flirt, Chat & Dating," and "Joostly - Dating App! Singles," with some accruing tens of thousands of downloads.

The main attack strategy is cunningly simple yet effective. Attackers share links via Arabic-language tutorial videos on YouTube for their fake dating app, which guide users to download the malicious software from a controlled domain.

Once installed, Arid Viper's malware boasts a feature set designed for espionage, where it can disable security notifications, collect comprehensive user data, and further compromise the device by deploying additional malware.

As the campaign unfolds, the scale of Arid Viper's ambition is clear. By exploiting the online dating scene, the group targets a broad demographic, amassing not just personal data but potentially gaining financial benefits as well. Android users, particularly Arabic-speaking individuals, are urged to exercise heightened caution to counter the deceitful tactics deployed by Arid Viper in this menacing cyber espionage campaign.