RedAlert Mobile Espionage Campaign Exploits Trojanized Rocket Alert App to Spy on Civilians

A newly identified mobile espionage campaign, called "RedAlert," has emerged during the ongoing Israel–Iran conflict. This operation exploits wartime anxiety and reliance on early-warning systems.

The campaign targets civilians by distributing a trojanized version of the Israeli Home Front Command's official Rocket Alert application. This malicious version aims to collect sensitive personal and geolocation data under the pretense of legitimate security notifications.

Researchers have identified that threat actors are using SMS-based phishing (smishing) to distribute malicious Android APKs labeled as urgent "Red Alert" updates. These fraudulent messages persuade users to sideload the fake app, bypassing the official Google Play Store, which is the only authentic source for the legitimate alert service.

Static and reverse-engineering analysis of the sample (RedAlert.apk) revealed a three-stage infection chain, which demonstrates a sophisticated persistence strategy:

Stage 1 – Loader Shell: Hooks into the Android IPackageManager service to spoof the app’s digital signature, returning a hardcoded 2014 signing certificate resembling the legitimate issuer. It also forges installer origin data to appear as though it originated from "com.android.vending" (Google Play Store). Stage 2 – Hidden Asset ("umgdn"): A concealed asset extracted from the app’s resources, dynamically loaded into memory via reflection. It reassigns internal directory paths to mask itself as part of the main application package. Stage 3 – Core Spyware Payload: Delivers the executable DebugProbesKt.dex, enabling full data exfiltration capabilities and establishing encrypted communications with attacker-controlled servers.

The public key infrastructure (PKI) spoofing effectively bypasses Android integrity checks, allowing the malware to operate with apparent legitimacy on infected devices. During active execution, the trojan requests elevated permissions, including access to SMS, contacts, and precise GPS location, framed as essential for alert delivery.

Once any permission is granted, background threads initiate real-time data exfiltration, continuously collecting:

Complete SMS inboxes, allowing interception of two-factor authentication (2FA) codes. Contact lists for social graph mapping. Live GPS coordinates of victims.

Dynamic network tracing uncovered persistent outbound traffic to specific domains and IPs associated with the threat’s data exfiltration infrastructure:

Type Value

C2 Domain api.ra-backup[.]com/analytics/submit.php

IP Addresses 44.208.242.141, 104.21.64.137, 172.67.137.156, 44.200.176.254, 216.45.58.148

The malware immediately organizes harvested data into categorized files before initiating upload loops over HTTP POST requests to command and control (C2) nodes. This campaign transforms a legitimate civil defense mechanism into a spyware platform, exploiting public trust during wartime. By linking civilian GPS data and intercepting SMS communications, attackers can deduce movement patterns and authentication credentials for critical services.

Security analysts recommend users verify apps only through trusted app stores, avoid sideloading emergency updates via links, and deploy mobile threat defense systems capable of detecting reflective and proxy-based code injections.

IP Address ASN Name Associated Traffic

216.45.58.148 ASN-QUADRANET-GLOBALUS Associated with api.ra-backup.com

44.208.242.141 AMAZON-AESUS Associated with api.pushy.me

44.200.176.254 AMAZON-AESUS Secondary AWS node

104.21.64.137 CLOUDFLARENETUS Proxy infrastructure / Blissroms API

172.67.137.156 CLOUDFLARENETUS Associated with redalert.me endpoints

Based on reporting by GBHackers.