Arid Viper poisons Android apps with AridSpy

ESET Research reports that the Arid Viper APT (aka APT‑C‑23) operated at least five campaigns since 2022 delivering a multistage Android spyware family called AridSpy through dedicated websites and trojanized apps targeting users in Palestine and Egypt; AridSpy dynamically downloads and loads encrypted payloads, abuses Accessibility services to keylog and capture messaging (WhatsApp/Facebook Messenger), takes periodic camera photos and audio recordings, and exfiltrates broad sensitive data to C2 servers (including Firebase-based C2), with IoCs and MITRE ATT&CK mappings provided.