Mobile Surveillance Monitor
Mobile Surveillance Monitor
  • Home
  • Surveillance Dashboard
  • Threat Workbook
  • Surveillance 101
  • About Us
  • Contact
  • More
    • Home
    • Surveillance Dashboard
    • Threat Workbook
    • Surveillance 101
    • About Us
    • Contact
  • Home
  • Surveillance Dashboard
  • Threat Workbook
  • Surveillance 101
  • About Us
  • Contact

SURVEILLANCE 101

Mobile Surveillance Monitor collects and publishes real-world spyware infections through the Surveillance Dashboard, using threat type classifications to help expose the tactics behind surveillance operations.


WHAT IS A THREAT EVENT?

Spyware relies on network interactions such as malware delivery, command instructions, user data exfiltration, and exploitation of device features. These events are tied to malware classifications and attribution to known threat groups. Our indicator and attribution database enables us to track spyware and provide actionable intelligence to uncover surveillance campaigns targeting high-risk users worldwide.

How We Identify, Monitor, And Measure Threats

Source Country

Source Country

Source Country

The country of the group distributing the spyware, determined through partner research and established attribution methods.

Target Country

Source Country

Source Country

The country where the targeted device was located at the time of the attack.

Threat Type

Source Country

Malware Name

Defined by malware features, distribution, indicators, and observed operational behavior.

Malware Name

Source Threat Group/APT

Malware Name

Also known as malware family, it is assigned by the research organization that discovered and documented the malware’s code and behavior.

Source Threat Group/APT

Source Threat Group/APT

Source Threat Group/APT

Attribution is based on code reuse, shared infrastructure (domains, IPs, URLs), and other forensic artifacts linked to known threat groups.

Threat Event Date

Source Threat Group/APT

Source Threat Group/APT

The timestamp of the attack, derived from device or network detection logs, or submission records from contributing researchers.

SURVEILLANCE GLOSSARY

DEVICE MALWARE THREATS

MOBILE MALWARE - Malicious software designed to target mobile devices, typically to steal data, monitor user behavior, or gain unauthorized access. Mobile malware threats now extend beyond surveillance to include financial fraud, credential theft, and lateral movement into corporate networks via personal devices. Some variants are capable of self-replication or disrupting normal device behavior.


SPYWARE – A type of mobile malware that covertly monitors a device and sends stored data—such as a user's contacts, messages, call logs, browsing history, and location—to a third party. Spyware can be installed via physical access or remotely through phishing links sent via messages, fake websites, or social media apps. Its primary purpose is surveillance, though some variants are also monetized through fraud or the resale of user data.


SURVEILLANCEWARE - A commercial subset of spyware designed for persistent monitoring of targeted users. It hides on the device and captures information such as live calls and background audio, camera screenshots or video, or location. It exfiltrates device content such as app data, passwords, call logs, messages, browsing activity, and app usage. Advanced variants can trigger location alerts, remotely download apps, send text messages, or even monitor encrypted apps like Signal, WhatsApp, or Telegram.


NOTE - MSM CLASSIFIES SURVEILLANCEWARE UNDER THE BROADER SPYWARE CATEGORY


TROJAN (Remote Access Trojan/RAT) – A Trojan disguises itself as legitimate software while executing malicious hidden functions. Mobile RATs can steal information, install additional payloads, or commit billing fraud without the user's knowledge.


ROOT ENABLER – Apps that gain privileged (root) device access. While commonly available for web download and used in "modding" communities to enable certain functions, root enablers are often used by spyware threat actors to bypass security controls and gain full access to system resources.


BACKDOOR – Code or software that grants covert access to device files or apps, bypassing standard authentication. Backdoors are used to maintain persistent access or deliver follow-on malware without user consent or visibility.


EXPLOIT - A piece of code or a technique that leverages a vulnerability in the device’s operating system or software to gain unauthorized privileges. It's often used to escalate access, disable protections, or takeover certain device controls.


INFOSTEALER - A class of trojan malware designed to extract and leak information about users such as credentials, SMS messages, location, and browsing activity without their knowledge. Infostealers operate silently and transmit user information to a remote server where it's often sold on the dark web, or is part of broader criminal surveillance or fraud campaign.

Research and Investigate

We have built a Threat Workbook with research and analysis tools and visualizations showing details behind surveillance threats and threat actors.  It provides the intelligence needed to investigate attacks and the actors responsible for enabling state-sponsored surveillance.

Find out more

MOBILE NETWORK THREATS

Surveillance threats can originate from adversaries who gain access to foreign mobile networks and abuse global signaling protocols to target users. These attacks are carried out using surveillance platforms that covertly send signaling messages, typically designed for international roaming through telecom infrastructure. Because these messages are handled by the network itself, spyware isn't needed on the target device to extract device information or intercept communications.


INFORMATION DISCLOSURE – Adversaries send signaling requests to the victim's home mobile network to retrieve the device unique subscriber identity (IMSI) assigned by the network, confirm whether the phone is active, if it's roaming on a foreign operator network, and identify the network equipment address currently serving the device. This reconnaissance enables further surveillance operations targeting the user.


LOCATION DISCOVERY – By sending signaling requests, attackers can remotely track the device location—down to a specific cell tower or even GPS coordinates without consent of the host network operator.


DENIAL OF SERVICE (DOS) – Network-based DoS attacks can disable device services by forcing disconnection from the network or blocking access to voice, SMS, or data services to temporarily disable phone communications.


COMMUNICATION INTERCEPTION – Attackers manipulate signaling routes to hijack calls, text messages or data. This is often achieved by impersonating the victim’s IMSI on a foreign network to trick the home network into rerouting traffic through actor-controlled infrastructurer.


FINANCIAL THEFT – In a financial theft attack, the attacker uses signaling exploits to impersonate a victim’s IMSI and issue fraudulent commands, leading to illegitimate billing charges or other loss of user funds.

How to Stop Malware Threats

Protecting yourself from spyware requires vigilance. While no solution offers complete protection, the following practices can significantly reduce your risk:


  1. Keep Your Device Updated – Regularly check and install system updates, including critical security-related fixes. Android and iOS devices often notify users when updates are available, but patches may be released before notifications are pushed. Manually check for updates on the Android Help Page or Apple's iOS page.
  2. Keep Your Apps Updated – Outdated apps are a common malware entry point used by threat actors. Enable automatic updates when possible, especially for web browsers, messaging, or social media apps. Regular updates close security gaps exploited by spyware.
  3. Use Mobile Security Tools – Modern mobile security apps can provide threat detection, block malicious websites and SMS phishing attempts, and alert users to apps requesting sensitive permissions. Security software such as iVerify and Lookout Mobile Endpoint Security (shown on the right) offer an added layer of defense against surveillance threats.
  4. Be Cautious With Links – You may receive an unusual message with a suspicious link, even from a known contact. Don't click it without first verifying if it's legitimate. Attackers often compromise trusted contacts to distribute malware via links or attachments.
  5. Avoid Third-Party App Stores - Unauthorized app stores often distribute cracked or modified versions of popular apps. These versions may contain embedded spyware or other malicious code. Stick to official app stores (Google Play, Apple App Store) to minimize risk.
  6. Beware of Suspicious Messages on Social Media – Adversaries often use social engineering to exploit empathy. Messages from unknown senders claiming to need help may include malicious links or attachments. Don’t engage and instead refer them to legitimate authorities or support organizations.
  7. Watch for Unusual Phone Behavior – Spyware is designed to operate silently, but warning signs may include:


  • Sudden battery drain
  • Overheating
  • Slow performance
  • Unexpected apps or system pop-ups


If you observe these symptoms, run a trusted security scan using mobile-specific security software and/or and consider consulting a known mobile security help desk.

Lookout Device Protection Malware Detection

Mobile Security & Antivirus Protection by Lookout

Copyright © 2025 Mobile Intelligence Alliance - All Rights Reserved.

Powered by

  • Mobile Dashboard View
  • Terms of Service
  • Brand Logos

This website uses cookies.

We only use cookies to analyze website traffic.  We do not store your information. Accepting the use of cookies will aggregate your data with all other user data.

DeclineAccept