4 new Android spyware samples linked to Iran's intel agency

4 new Android spyware samples linked to Iran's intel agency

: Persians added snooping capabilities to DCHSpy after Israeli bombs fell

Spyware Uses Starlink Name to Trick Iranians Desperate for Unfiltered Internet

DCHSpy appears to be the creation of an Iranian state-sponsored hacking group known as MuddyWater, according to the cybersecurity vendor Lookout.

DCHSpy– Iran’s MuddyWater Deploys New Android Spyware via Fake VPN Apps

In late June 2025, about a week after Israeli airstrikes struck Iran’s nuclear facilities, cybersecurity researchers uncovered a stealthy new threat on Iranian dissidents’ Android phones. Four new samples of the espionage malware known as DCHSpy have surfaced, disguised as innocuous VPN apps named Earth VPN and Comodo VPN. One tainted app even carried “Starlink” […]

Spyware Exploits Starlink Name to Deceive Iranians Seeking Unfiltered Internet

Cybersecurity firm Lookout has identified an Android-based spyware program impersonating the Starlink brand to trick internet users in Iran into installing malicious software. Spyware Linked to Iranian State-Sponsored Group MuddyWater The spyware, known as DCHSpy, is linked to MuddyWater, an Iranian state-sponsored hacking group connected to Iran’s Ministry of Intelligence and Security. The malware can steal call logs, SMS messages, location dat…

Iran’s Expanding Digital Repression: From Domestic Surveillance to Global Cyber Threats - Iran News Update

Regime-backed spyware, phishing campaigns, and advanced surveillance networks target activists at home and abroad The Iranian regime’s digital repression has grown into a transnational threat, targeting not only dissidents inside Iran but also political opponents, journalists, and academics across borders. Employing sophisticated surveillance tools and offensive cyber tactics, the regime is waging a digital war on free expression, privacy, and d…

Iran-Linked DCHSpy Android Malware Masquerades as VPN Apps to Spy on Dissidents

Cybersecurity researchers have unearthed new Android spyware artifacts that are likely affiliated with the Iranian Ministry of Intelligence and Security (MOIS) and have been distributed to targets by masquerading as VPN apps and Starlink, a satellite internet connection service offered by SpaceX. Mobile security vendor Lookout said it discovered four samples of a surveillanceware tool it tracks