Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Lookout Threat Lab has uncovered a mobile forensics application called Massistant, used by Chinese law enforcement to extract extensive data from mobile devices. Believed to be the successor of MFSocket, Massistant requires physical access to install and is not distributed through official app stores. It collects sensitive information including GPS data, SMS messages, images, audio, contacts, and phone services. The tool is associated with Xiamen Meiya Pico Information Co., Ltd., a Chinese technology company controlling a significant portion of China's digital forensics market. Massistant introduces new features like Accessibility Services to bypass device security prompts and support for additional messaging apps. The discovery raises concerns about data privacy for travelers to China, as law enforcement can potentially access and analyze confiscated devices without a warrant.

Massistant is a mobile forensic tool developed by Xiamen Meiya Pico Information Co., Ltd., a prominent Chinese digital forensics company. It is designed for use by Chinese law enforcement agencies to extract extensive data from mobile devices. Massistant is considered the successor to the earlier tool MFSocket and introduces enhanced capabilities such as leveraging Accessibility Services to bypass device security prompts, enabling data extraction without user consent or interaction. The tool requires physical access to the target device for installation and is not distributed via official app stores, indicating its use in controlled, law enforcement contexts rather than widespread malware campaigns. Massistant collects a broad range of sensitive data including GPS location history, SMS messages, images, audio recordings, contacts, and phone service information. It also supports data extraction from additional messaging applications beyond those targeted by its predecessor. The discovery of Massistant raises significant privacy concerns, particularly for travelers to China, as law enforcement can confiscate devices and extract data without a warrant or user knowledge. While it is not malware in the traditional sense, it functions as a forensic surveillance tool with capabilities that can circumvent standard mobile security protections. There are no known exploits in the wild beyond its intended forensic use, and it is not a remotely exploitable threat but rather a physical-access forensic tool.

MD5 of 93c5cd3a0bb04012927ccd29e505772492fcfbee

MD5 of 8659920f99a96c294c9857a761ce0729f3a8f2f7

MD5 of 895ad87f382de53f7323117b47150eaf0550cbf4

MD5 of c17e9325a6932ff8b725b18e4ddcb6dadab99457

MD5 of 215bd2972c5598787addad911915b9a04932d68d

MD5 of 256c357f884f33c032d2352ee6ff73fe94da83a8

SHA256 of c17e9325a6932ff8b725b18e4ddcb6dadab99457

SHA256 of 93c5cd3a0bb04012927ccd29e505772492fcfbee

SHA256 of 256c357f884f33c032d2352ee6ff73fe94da83a8

SHA256 of 215bd2972c5598787addad911915b9a04932d68d

SHA256 of 895ad87f382de53f7323117b47150eaf0550cbf4

SHA256 of 8659920f99a96c294c9857a761ce0729f3a8f2f7

Detailed information about Chinese Mobile Forensic Tooling Discovered. Get real-time updates, technical details, and mitigation strategies.

Chinese Mobile Forensic Tooling Discovered - Live Threat Intelligence - Threat Radar | OffSeq.com

Chinese Mobile Forensic Tooling Discovered

Iranian cyber actors have been identified impersonating a German model agency in a suspected espionage operation. The attackers created a fraudulent website mimicking the authentic agency's branding and content, which triggers obfuscated JavaScript to capture detailed visitor information. This data collection enables selective targeting. The website also replaces a real model's profile with a fake one, likely for social engineering purposes. The operation's complexity and methods suggest involvement of an Iranian threat group, possibly overlapping with Agent Serpens (APT35 or Charming Kitten). This group is known for targeting Iranian dissidents, journalists, and activists abroad. The fake website includes sophisticated data collection routines and dynamic profile alterations, indicating an ongoing and evolving threat.

This threat involves Iranian cyber actors, likely linked to the advanced persistent threat (APT) group known as Agent Serpens (also referenced as APT35 or Charming Kitten), conducting a sophisticated espionage campaign by impersonating a legitimate German model agency. The attackers have created a fraudulent website using the domains megamodelstudio.com and www.megamodelstudio.com that closely mimics the authentic agency's branding and content. This counterfeit site employs obfuscated JavaScript code designed to capture detailed visitor information, including device fingerprints, browser details, and user interaction patterns. Such data collection enables the threat actors to selectively identify and target individuals of interest, enhancing the precision of their espionage efforts. Additionally, the attackers dynamically replace a real model's profile on the site with a fabricated one, likely as a social engineering tactic to lure targets into engagement or facilitate further reconnaissance and exploitation. The operation's complexity, including advanced data collection routines and dynamic content manipulation, indicates an ongoing and evolving threat rather than a one-off phishing attempt. The campaign aligns with known tactics, techniques, and procedures (TTPs) of Agent Serpens, who historically target Iranian dissidents, journalists, and activists abroad, suggesting a focus on intelligence gathering rather than mass disruption or financial gain. The absence of known exploits in the wild and the medium severity rating reflect the targeted nature of this campaign, which relies heavily on social engineering and information harvesting rather than direct system compromise or malware deployment.

Detailed information about Iranian Cyber Actors Impersonate Model Agency in Suspected Espionage Operation. Get real-time updates, technical details, and mitigat

Title	Severity	Type	Source	Date

Threats Tagged 'data collection'

Filter Threats

Threats Tagged 'data collection'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility