"Spyware Caught Masquerading as Israeli Rocket Alert Applications"

In the wake of the Israel-Gaza conflict, researchers at Cloudflare have observed threat actors targeting Israeli rocket alerting applications to spread fear and mobile spyware.  The researchers noted that with thousands of rockets launched since Hamas attacked Israel on October 7, individuals in Israel rely on several mobile applications to receive timely alerts about incoming airstrikes and seek safety.  Pro-Palestinian hacktivist group AnonGhost claimed to have targeted various such applications, succeeding in compromising at least one.  The researchers noted that after exploiting a vulnerability in the "Red Alert: Israel" application by Kobi Snir, the group was able to intercept requests and expose APIs and servers and was seen sending fake alerts to users, including nuclear bomb messages.  On October 12, a threat actor created a website hosting a malicious version of the "RedAlert – Rocket Alerts" open-source mobile application developed by Elad Nava in an attempt to infect users with spyware.  The malicious application was built using the original code but was also packed with the ability to collect sensitive user information, including contacts, call logs, messages, account information, SIM details, and a list of the installed applications.  The website hosting the spyware version of RedAlert has been taken offline, but all users who might have installed the malicious application are at risk and should consider immediately cleaning up their devices.  The researchers stated that to determine whether a user installed the malicious application, users should check for the permissions the software has requested, including access to call logs, contacts, phone, and SMS. 

SecurityWeek reports: "Spyware Caught Masquerading as Israeli Rocket Alert Applications"