MuddyWater Leveraging DCHSpy For Israel-Iran Conflict

MuddyWater, an Iranian cyber espionage group, is deploying DCHSpy, an Android surveillance malware, amid the Israel-Iran conflict. DCHSpy is distributed through malicious VPN apps promoted on Telegram and can collect extensive data including WhatsApp messages, contacts, SMS, files, location, call logs, audio recordings, and photos. Recent variants have improved data exfiltration capabilities, particularly targeting WhatsApp and specific files. The malware uses lures related to StarLink to exploit internet outages in Iran. It shares infrastructure with SandStrike, another Android malware targeting Bahá’í practitioners. This campaign poses significant espionage risks to Android users in targeted regions and conflict zones.

• Multiple Lenovo Tablets shipped with a known private test key for Android Verified BootHighVulnerability2026-10-20
• YuanKong RAT: the Android remote-control service that stamps its operators' names into every buildMalware2026-10-16
• Android gets AI defenses against messaging scams, fake callsNews2026-10-15
• Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized CopiesMalware2026-10-15
• VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation LogicMediumVulnerability2026-10-14