MalwarePublished 3 Mar 2026

RedAlert Trojan Campaign: Fake Emergency Alert App Spread via SMS Spoofing Israeli Home Front Command

Source AlienVault OTX General

Description

A malicious SMS spoofing campaign is spreading a fake version of Israel's 'Red Alert' emergency app amid ongoing conflict. The trojanized Android app, disguised as a trusted warning platform, can steal SMS, contacts, and location data while appearing legitimate. The campaign exploits public fear during crises to deploy mobile spyware. The malware uses sophisticated techniques to bypass security checks, including package manager hooking and dynamic payload loading. It mirrors the official app's interface but requests high-risk permissions. The malware continuously tracks GPS coordinates and exfiltrates data to attacker-controlled infrastructure, posing severe strategic and physical security risks. This campaign erodes trust in emergency response systems and could potentially be used for targeted attacks or to optimize missile targeting.

Impact

The impact of this campaign is multifaceted and severe. For individuals, it results in loss of privacy through theft of SMS messages, contacts, and continuous location tracking. For organizations, especially government and emergency response agencies, it erodes trust in critical public safety infrastructure, potentially leading to reduced compliance with legitimate alerts. Strategically, the exfiltrated GPS and communication data can be used to optimize missile targeting or conduct precision attacks, increasing physical security risks. The campaign could disrupt emergency response coordination and civilian safety during crises. The malware's ability to evade detection complicates incident response and forensic investigations. The broader geopolitical implications include escalation of conflict and destabilization of regional security. The campaign's focus on Israeli users makes Israel the primary target, but spillover effects could affect neighboring countries and allied organizations. The erosion of trust in emergency systems could have long-term societal impacts beyond the immediate technical damage.

Defensive guidance

1. Educate users to only download the official Red Alert app from trusted sources such as the Google Play Store or official government websites, and to be wary of SMS messages claiming to be from the Home Front Command that include app download links. 2. Implement mobile device management (MDM) solutions in organizational environments to restrict installation of apps from unknown sources and enforce app whitelisting. 3. Use mobile threat defense (MTD) tools capable of detecting package manager hooking and dynamic payload loading behaviors indicative of this malware. 4. Monitor network traffic for connections to known malicious domains such as api.ra-backup.com and block these at network perimeter devices. 5. Employ endpoint detection and response (EDR) solutions on Android devices that can detect suspicious permission requests and anomalous GPS tracking activities. 6. Conduct regular threat intelligence updates incorporating the provided malware hashes and URLs to enable timely detection and blocking. 7. Coordinate with national cybersecurity agencies to disseminate alerts and guidance to the public during conflict periods to reduce the effectiveness of social engineering. 8. Encourage users to verify emergency alerts through official channels and report suspicious messages or apps immediately. 9. For organizations, implement layered security controls including network segmentation and strict access controls to limit data exposure if a device is compromised. 10. Regularly audit and update incident response plans to include scenarios involving mobile spyware and misinformation campaigns.

Indicators of compromise

Domains 1

api.ra-backup.com

URLs 2

https://api.ra-backup.com/analytics/submit.php
https://www.shirideitch.com/wp-content/uploads/2022/06/RedAlert.apk

Hashes 2

9c6c67344fecd8ff8dbbee877aad7efc
83651b0589665b112687f0858bfe2832ca317ba75e700c91ac34025ee6578b72

Community reviews

Loading reviews…