Hackers pose as IDF to sneak spyware onto Israelis’ phones

(Representative/AFP image. Israeli first responders work at the national MDA dispatch center in Ramla.)

• Hackers use fake alert app to target Israelis with spyware
• Malicious app steals location, texts, passwords, and contacts
• Arid Viper group suspected of exploiting trusted alerts

Did our AI summary help?

Hackers are targeting Israelis with spyware masquerading as a smartphone app that issues safety alerts, according to new cybersecurity research.

The cyberespionage campaign, identified following the US and Israeli attacks on Iran, has attempted to trick Israelis into downloading the malicious app by sending text messages that appear to originate from the Home Front Command, a unit of the Israel Defense Forces, according to a report published Friday by the threat research unit at Swiss cybersecurity firm Acronis.

The messages advise the recipient to download a new version of the official “red alert” Android app, which issues warnings about imminent rocket attacks.

However, anyone who follows the guidance and installs the app will be unwittingly downloading spyware onto their device, Acronis’ researchers discovered. The malicious version of the app secretly records precise location data and can steal text messages, passwords, contacts and other information stored on the phone, according to the report.

The hackers behind the attacks are likely linked to a group known as Arid Viper, according to the report, which other cybersecurity researchers have previously blamed for espionage targeting Israeli soldiers and people in Egypt and Palestine.

Acronis said the hackers were “a capable and well-resourced threat actor operating with clear objectives” and added that the hacking campaign “illustrates how trusted emergency infrastructure can be exploited during periods of conflict.”

Attackers also have attempted to breach surveillance cameras in Israel and other countries through the Middle East, Check Point Software Technologies Ltd. said in a report published on Wednesday.

Several Iranian-aligned hacking groups have claimed attacks on Israeli companies and government agencies in recent days. But cyberattacks have as yet not played any decisive role in the conflict, which began with a series of US and Israeli bombings of Iranian targets on Feb. 28. On March 4, Israel said it had attacked a series of Iranian military compounds in eastern Tehran, including a cyber-warfare headquarters.