Osservatorio Nessuno uncovered Morpheus spyware spreading via fake Android apps to steal data, highlighting rising covert surveillance tools.

The non-partisan, non-religious, nonprofit organization Osservatorio Nessuno exposed a new spyware called Morpheus, distributed through fake Android apps posing as updates. Once installed, it can steal extensive data from the infected devices. The report shows strong demand from law enforcement and intelligence agencies, fueling a growing market of spyware vendors, many operating quietly outside public scrutiny.

Attackers used a typical low-cost spyware tactic: disrupt a service and trick the victim into installing a fake app to restore it. In this case, targets received an SMS linking to a site impersonating an ISP. The first stage, a dropper app, installs a hidden second-stage payload embedded within it. It checks if the payload is already present, then silently deploys it with minimal user awareness.

The second stage disguises itself as legitimate system components, using fake icons and names to appear trustworthy. It forces users to grant dangerous permissions, including Accessibility access, which allows it to read screens, interact with apps, and capture sensitive data.

“After granting Accessibility permissions, the spyware starts a Permission Workflow that creates an overlay with a fake update process and a fake reboot screen. In background, the workflow performs all the steps to grant all the needed permissions. This includes enabling Developer Options, turning on Wireless Debugging, and locally pairing to the ADB daemon.” reads the report published by the Osservatorio Nessuno. “Conveniently, during the fake update the app disables the touchscreen by setting FLAG_NOT_TOUCHABLE on the whole full-screen overlay, leaving the user partially unable to respond to the infection.”

The malware also gains persistence by restarting after reboot and can request device admin privileges, making removal difficult. Overall, it enables long-term, covert surveillance of the infected device.

The spyware abuses overlay windows and Accessibility features to take control of the device and bypass protections. Using the powerful SYSTEM_ALERT_WINDOW permission, it displays fake screens, such as updates or reboots, while secretly granting itself permissions in the background, even disabling touch input to limit user control. It can trick victims into approving actions like linking a WhatsApp account by showing a fake biometric prompt.

It also enables Wireless Debugging and connects to ADB to gain elevated privileges, silently granting itself sensitive permissions, disabling security protections like camera/mic indicators and Play Protect, and turning off antivirus tools.

“In the third phase the spyware disables a number of known Antivirus software, including Google’s own SafetyCore, Bitdefender, Sophos, Avast, AVG, Malwarebytes, along with a handful of smaller “cleaner/antivirus” apps popular on low end devices.” continues the report. “None of these requires root, and persists across reboots since the Android security model treats user’s installed anti-malware software like ordinary apps.”

Finally, it adjusts system settings across different Android versions to ensure persistence, avoid detection, and maintain full access to the device.

The analysis of the source code suggests an Italian origin for the spyware, based on language clues and references like “aprafoco” and “Gomorra.” The malware supports multiple languages and Android devices, showing broader targeting. Its infrastructure uses encrypted configs, Italian-hosted servers, and domains linked to small ISPs and obscure entities with generic details.

The researchers found ties between hosting providers, fake or opaque companies, and shared contacts. The phishing domain is registered to a small Italian firm with minimal activity and links to other questionable businesses. Overlapping financial and corporate connections suggest a network of related entities potentially supporting the spyware operation while masking its true ownership.

Osservatorio Nessuno concluded that the spyware is linked to IPS Intelligence, an Italian firm active for over 30 years in lawful interception technologies used by governments to monitor communications through telecom and internet providers.

“While IPS Intelligence is a well‑known commercial surveillance provider, this is, to our knowledge, the first report linking them to the distribution and operation of spyware.” concludes the report. “Morpheus is extremely invasive: it can record audio and video, silently pair a WhatsApp device, erase evidence, and deliberately weaken the security of the infected phone, among other malicious capabilities.”

The researchers did not provide details on how they isolated or identified the sample, so the exact collection and analysis process remains undisclosed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, spyware)

New York’s latest budget proposal could fundamentally change how 3D printers work—requiring built-in software that scans and blocks certain designs. Supporters say it’s about stopping ghost guns. Critics say it opens the door to surveillance and limits innovation. In this episode, we break down what’s actually in the proposal, why it’s raising alarms across the […]

The post New York’s 3D Printing Crackdown: Security or Surveillance? appeared first on Shared Security Podcast.

The post New York’s 3D Printing Crackdown: Security or Surveillance? appeared first on Security Boulevard.

ICE has admitted that it uses spyware from the Israeli company Graphite.

Grupo Seguritech is a Mexican surveillance company that is expanding into the US.

Citizen Lab reported that law enforcement used the surveillance tool Webloc to track up to 500M devices via ad data globally.

A report by Citizen Lab revealed that law enforcement agencies in the U.S., Hungary, and El Salvador used a surveillance tool called Webloc to track devices via advertising data, potentially affecting up to 500 million devices. Developed by Cobwebs Technologies and now sold by Penlink, the tool is widely used by agencies like ICE, the military, and multiple police departments.

Cobwebs Technologies has links to spyware vendor Quadream through its founder. Its Webloc tool is sold alongside the Tangles intelligence platform and is used globally by law enforcement.

“Our research shows that intrusive and legally questionable ad-based surveillance (i.e. without a warrant or adequate oversight) is being used by military, intelligence, and law enforcement agencies down to local police units in several countries across the globe.” reads the report published by Citizen Lab.

Citizen Lab found that the Webloc surveillance tool is used by governments in Hungary, El Salvador, and the United States, marking the first confirmed use of ad-based tracking in Europe. The tool is also linked to multiple law enforcement agencies and possibly other countries.

Despite limited transparency from European authorities, evidence suggests broader global use.

Ad-based surveillance emerged after a 2020 investigation revealed U.S. agencies buying smartphone location data from apps via brokers. Since then, multiple government bodies have used this data for surveillance purposes.

Using advertising data sources, it tracks devices via mobile advertising IDs, linking them to GPS, Wi-Fi, and behavioral data such as apps used, interests, and demographics. It supports geofencing, travel tracking, and relationship mapping between devices, enabling large-scale surveillance.

The data allowed intelligence and law enforcement to cover behavior, traits, and movements of millions. Known as ADINT, it relies on data from ad auctions (RTB) and embedded app trackers (SDKs), collecting identifiers, geolocation, and user habits. Despite claims of anonymity, such data can identify individuals. This practice enables large-scale tracking but raises serious privacy and legal concerns, as it may expose sensitive personal details and bypass traditional oversight.

Webloc offers both historical and near real-time geolocation data, with updates occurring every 4 to 24 hours and access to up to three years of past records. The platform processes extensive personal data, including device identifiers (e.g., advertising IDs, IPs), timestamps, GPS and Wi-Fi-based locations, inferred places like home or work, device details, and behavioral profiles derived from ad-targeting segments. It can also track apps used and user characteristics such as age, gender, and interests. Although vendors claim GDPR compliance and user consent, such assertions remain disputed. Even without explicit demographic data, location traces can reveal highly sensitive insights about individuals’ habits and identities. The exact data sources remain unclear but likely include SDK- and RTB-based pipelines. Coverage, accuracy, and current practices are difficult to verify.

Researchers uncovered additional infrastructure linked to Cobwebs by pivoting on TLS certificates, identifying 14 new servers, some exposing broken login pages tied to products like Trapdoor and Weaver. Overall, 219 active servers were assessed as likely supporting Cobwebs deployments, with a broader infrastructure of 298 servers across 25 countries, heavily concentrated in the U.S., Netherlands, and Germany.

“Based on the above research, we identified 219 active servers we assess as associated with Cobwebs product deployments. With the help of common IP geolocation tools we then retrieved the likely server locations of the corresponding IP addresses.” continues the report. “As a result, we found that many potential Cobwebs product servers are located in the U.S. (126), Netherlands (32), Singapore (17), Germany (8), Hong Kong (8), and the U.K. (7). We also identified potential product servers located in Kenya, Iraq, United Arab Emirates, Indonesia, India, Mexico, Colombia, Australia, Japan, and in several European countries (France, Sweden, Norway, Ireland, and Cyprus). We found only one potential product server located in Cobwebs Technologies’ home country, Israel.”

Most are hosted on Microsoft Azure. Evidence suggests dynamic infrastructure, with some servers active only briefly and others persisting for years.

Analysis also points to specialized deployments such as “Webloc” and “Trapdoor,” inferred from hostname patterns (e.g., “wl” and “td”). Trapdoor, in particular, emerges as a web-based social engineering platform capable of phishing, data extraction, and limited client-side interaction via browsers, potentially facilitating malware delivery without embedding it directly.

Corporate links connect Cobwebs to other surveillance vendors like Quadream, with overlapping leadership and investment networks. Despite vendor claims of compliance, the report highlights significant opacity around operations, customers, and legal safeguards. It ultimately characterizes Webloc as a highly intrusive mass surveillance system leveraging commercial data, raising serious concerns about proportionality, legality, and civil liberties.

Cobwebs Technologies and its successor Penlink provide limited transparency about Webloc, a mass surveillance platform leveraging data from mobile apps and digital advertising. The system enables large-scale monitoring of individuals’ movements and behaviors, often without probable cause, raising significant privacy concerns. Its use illustrates “mission creep,” expanding from serious investigations to routine cases. The legality of such surveillance is widely debated, especially regarding consent and data anonymization. Regulatory scrutiny in the U.S. and Europe highlights potential violations of privacy laws. The report urges stronger oversight, reforms in data practices, and further investigation into Webloc’s data sources, usage, and impact on civil liberties.

“The systematic misuse of data purchased from everyday consumer apps and digital advertising for warrantless surveillance raises serious concerns about civil liberties and fundamental rights, particularly when used to target vulnerable groups such as immigrants or those who exercise their freedom of expression and assembly rights.” concludes the report. “Ad-based surveillance raises specific concerns when applied by organizations or governments, which are prone to authoritarianism or have weak or limited oversight. It generally raises concerns when governments lack a lawful basis to use it or when the underlying data is processed without a lawful basis.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Webloc)

A landmark jury verdict has found Meta and YouTube negligent in a social media addiction case, raising major questions about platform accountability and legal protections under Section 230. This episode covers the details of the case, why the ruling is significant, and what it could mean for the future of social media, privacy, and cybersecurity. […]

The post Meta & YouTube Found Negligent: A Turning Point for Big Tech? appeared first on Shared Security Podcast.

The post Meta & YouTube Found Negligent: A Turning Point for Big Tech? appeared first on Security Boulevard.

WebinarTV searches the internet for public Zoom invites, joins the meetings, secretly records them, and publishes (alternate link) the recordings. It doesn’t use the Zoom record feature, so Zoom can’t do anything about it.

In this episode, Tom Eston and co-host Scott Wright discuss research showing that Tire Pressure Monitoring Systems (TPMS) can create privacy risks because the sensors broadcast unencrypted, uniquely identifying wireless signals that could be used to track vehicles. They reference a 10-week study by researchers at IMDEA in Madrid that collected about 6 million signals […]

The post The Hidden Tracking Risk Inside Your Tires appeared first on Shared Security Podcast.

The post The Hidden Tracking Risk Inside Your Tires appeared first on Security Boulevard.

Sen. Ron Wyden is warning us of an abuse of Section 702:

Wyden took to the Senate floor to deliver a lengthy speech, ostensibly about the since approved (with support of many Democrats) nomination of Joshua Rudd to lead the NSA. Wyden was protesting that nomination, but in the context of Rudd being unwilling to agree to basic constitutional limitations on NSA surveillance. But that’s just a jumping off point ahead of Section 702’s upcoming reauthorization deadline. Buried in the speech is a passage that should set off every alarm bell:

There’s another example of secret law related to Section 702, one that directly affects the privacy rights of Americans. For years, I have asked various administrations to declassify this matter. Thus far they have all refused, although I am still waiting for a response from DNI Gabbard. I strongly believe that this matter can and should be declassified and that Congress needs to debate it openly before Section 702 is reauthorized. In fact, ...

The post Sen. Wyden Warns of Another Section 702 Abuse appeared first on Security Boulevard.

Sen. Ron Wyden is warning us of an abuse of Section 702:

Wyden took to the Senate floor to deliver a lengthy speech, ostensibly about the since approved (with support of many Democrats) nomination of Joshua Rudd to lead the NSA. Wyden was protesting that nomination, but in the context of Rudd being unwilling to agree to basic constitutional limitations on NSA surveillance. But that’s just a jumping off point ahead of Section 702’s upcoming reauthorization deadline. Buried in the speech is a passage that should set off every alarm bell:

There’s another example of secret law related to Section 702, one that directly affects the privacy rights of Americans. For years, I have asked various administrations to declassify this matter. Thus far they have all refused, although I am still waiting for a response from DNI Gabbard. I strongly believe that this matter can and should be declassified and that Congress needs to debate it openly before Section 702 is reauthorized. In fact, when it is eventually declassified, the American people will be stunned that it took so long and that Congress has been debating this authority with insufficient information.

Over the decades, we have learned to take Wyden’s warnings seriously.

Tom Eston interviews offensive AI researcher and PhD candidate Andrew Wilson, a former Bishop Fox partner who helped grow the firm from under 20 people to nearly 500, built award-winning AI solutions for SOC modernization, founded Cactus Con, and relocated his family to Guadalajara to open and scale a Bishop Fox office. They discuss Mexico’s […]

The post The Real State of Offensive Security: AI, Penetration Testing & The Road Ahead with Andrew Wilson appeared first on Shared Security Podcast.

The post The Real State of Offensive Security: AI, Penetration Testing & The Road Ahead with Andrew Wilson appeared first on Security Boulevard.

This episode discusses Meta Ray-Ban Smart Glasses, which blend a camera, microphone, AI features, and social media integration into sunglasses that look like normal fashion eyewear, raising major privacy concerns. It highlights reports that footage captured by the glasses may be reviewed by human contractors to help train Meta’s AI systems, and notes critics’ concerns […]

The post The Privacy Problem With Meta’s Ray-Ban Smart Glasses appeared first on Shared Security Podcast.

The post The Privacy Problem With Meta’s Ray-Ban Smart Glasses appeared first on Security Boulevard.

In a move that bucks the entire industry trend, TikTok has confirmed it will not implement end-to-end encryption (E2EE) for direct messages on its platform — arguing that E2EE would make users less safe. We break down what’s really going on: the child safety argument, the privacy counterargument, the geopolitical questions surrounding ByteDance, and what […]

The post TikTok Says No to End-to-End Encryption: Here’s Why That’s a Big Deal appeared first on Shared Security Podcast.

The post TikTok Says No to End-to-End Encryption: Here’s Why That’s a Big Deal appeared first on Security Boulevard.

The Federal Bureau of Investigation (FBI) is probing suspicious activity on an internal system containing sensitive surveillance and investigation data.

The FBI is investigating suspicious cyber activity affecting an internal system that stores sensitive data tied to surveillance operations and investigations, The Associated Press reports. According to a notification sent to members of the United States Congress, the bureau is assessing the scope and potential impact of the incident.

The investigation into abnormal log activity related to an internal network system began on February 17, 2026. Although the system is unclassified, it stores law-enforcement sensitive data, including surveillance records from legal tools such as pen register and trap-and-trace orders, along with personally identifiable information linked to investigations.

A pen register is a surveillance tool used by law enforcement agencies to record numbers dialed from a phone line. It collects call metadata but not content, helping investigators map communication patterns and identify contacts during investigations.

“The affected system is unclassified and contains law enforcement sensitive information, including returns from legal process, such as pen register and trap and trace surveillance returns, and personally identifiable information pertaining to subjects of FBI investigations,” reads the notification, according to The Associated Press.

The FBI confirmed the incident, stating it had identified and addressed suspicious activity on its networks using all available technical capabilities.

“The FBI identified and addressed suspicious activities on FBI networks, and we have leveraged all technical capabilities to respond,” the FBI said. “We have nothing additional to respond.”

The bureau did not reveal further details nor attribute the attack to any threat actors. The FBI noted the attackers used “sophisticated” techniques, including exploiting a commercial ISP’s infrastructure, reflecting long-standing foreign targeting of U.S. federal agencies for espionage.

In early August, Politico reported a major cyberattack on the federal judiciary’s electronic case filing system, potentially exposing sensitive court data across multiple states. The breach may have compromised the identities of confidential informants in federal criminal cases. The Administrative Office of U.S. Courts first assessed the severity around July 4, involving the Justice Department and affected district courts.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Explore how advancements in surveillance infrastructure and the democratization of intelligence have transformed espionage.

The post The Worm Turns – When the Hunter Becomes the Hunted Mass Surveillance and the Weaponization of the Data We Voluntarily Create appeared first on Security Boulevard.