{ "id": "428004c4-61fa-4003-bb86-b73369b1d1e7", "created_at": "2026-04-06T00:18:41.811099Z", "updated_at": "2026-04-10T03:20:54.107435Z", "deleted_at": null, "sha1_hash": "9464f50a063eb0ca722e8ccc1ea81352d61d9b34", "title": "Google: Predator spyware infected Android devices using zero-days", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 977549, "plain_text": "Google: Predator spyware infected Android devices using zero-days\r\nBy Sergiu Gatlan\r\nPublished: 2022-05-22 · Archived: 2026-04-05 21:04:54 UTC\r\nGoogle's Threat Analysis Group (TAG) says that state-backed threat actors used five zero-day vulnerabilities to install\r\nPredator spyware developed by commercial surveillance developer Cytrox.\r\nIn these attacks, part of three campaigns that started between August and October 2021, the attackers used zero-day exploits\r\ntargeting Chrome and the Android OS to install Predator spyware implants on fully up-to-date Android devices.\r\n\"We assess with high confidence that these exploits were packaged by a single commercial surveillance company, Cytrox,\r\nand sold to different government-backed actors who used them in at least the three campaigns discussed below,\" said Google\r\nTAG members Clement Lecigne and Christian Resell.\r\nhttps://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nThe government-backed malicious actors who purchased and used these exploits to infect Android targets with spyware are\r\nfrom Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain, and Indonesia, according to Google's analysis.\r\nThese findings align with a report on Cytrox mercenary spyware published by CitizenLab in December 2021, when its\r\nresearchers discovered the malicious tool on the phone of exiled Egyptian politician Ayman Nour.\r\nNour's phone was also infected with NSO Group's Pegasus spyware, with the two tools being operated by two different\r\ngovernment clients per CitizenLab's assessment.\r\nZero-days exploited in three campaigns targeting Android users\r\nThe five previously unknown 0-day security vulnerabilities used in these campaigns include:\r\nCVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome\r\nCVE-2021-1048 in Android\r\nThe threat actors deployed exploits targeting these zero-days in three separate campaigns:\r\nCampaign #1 - redirecting to SBrowser from Chrome (CVE-2021-38000)\r\nCampaign #2 - Chrome sandbox escape (CVE-2021-37973, CVE-2021-37976)\r\nCampaign #3 - Full Android 0-day exploit chain (CVE-2021-38003, CVE-2021-1048)\r\n\"All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email.\r\nThe campaigns were limited — in each case, we assess the number of targets was in the tens of users,\" the Google TAG\r\nanalysts added.\r\n\"Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the\r\nbrowser to a legitimate website. If the link was not active, the user was redirected directly to a legitimate website.\"\r\nThis attack technique was also used against journalists and other Google users who were alerted that they were the target\r\nof government-backed attacks.\r\nhttps://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/\r\nPage 3 of 4\n\nSpyware implant dropped using Android banking trojan\r\nIn these campaigns, the attackers first installed the Android Alien banking trojan with RAT functionality used to load the\r\nPredator Android implant, allowing recording audio, adding CA certificates, and hiding apps.\r\nThis report is a follow-up to a July 2021 analysis of four other 0-day flaws discovered in 2021 in Chrome, Internet Explorer,\r\nand WebKit (Safari).\r\nAs Google TAG researchers revealed, Russian-backed government hackers linked to the Russian Foreign Intelligence\r\nService (SVR) exploited the Safari zero-day to target iOS devices belonging to government officials from western European\r\ncountries.\r\n\"TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or\r\nsurveillance capabilities to government-backed actors,\" Google TAG added on Thursday.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/\r\nhttps://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.bleepingcomputer.com/news/security/google-predator-spyware-infected-android-devices-using-zero-days/" ], "report_names": [ "google-predator-spyware-infected-android-devices-using-zero-days" ], "threat_actors": [], "ts_created_at": 1775434721, "ts_updated_at": 1775791254, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/9464f50a063eb0ca722e8ccc1ea81352d61d9b34.pdf", "text": "https://archive.orkl.eu/9464f50a063eb0ca722e8ccc1ea81352d61d9b34.txt", "img": "https://archive.orkl.eu/9464f50a063eb0ca722e8ccc1ea81352d61d9b34.jpg" } }