AridViper__2020__APT_C_23_group_evolves_its_Android_spyware_WeLiveSecurity.pdf

ESET researchers describe a new variant of Android spyware (Android/SpyC23.A) used by APT‑C‑23 (Two‑tailed Scorpion) that impersonates messaging apps and fake app stores to persuade victims to grant invasive permissions; the malware can record audio, camera, screen and calls (including WhatsApp), read notifications from popular messaging apps, exfiltrate contacts/SMS/files, hide itself, dynamically resolve obfuscated C2 servers and includes multiple IoCs and hashes — ESET recommends installing apps only from Google Play and using updated mobile security.