badbazaar
- First seen
- 2021-09-01 00:00:00
- Malware type
- spyware, keylogger, screen-capture
- Family
- Malware family
- Last IoC activity
- 2026-07-21 04:37:59
- Profile updated
- 2026-07-07 14:04:19
Context
BadBazaar is a type of malware primarily functioning as a spyware. Designed to compromise Android and iOS devices, it is often distributed through malicious apps downloaded from unofficial app stores, third-party websites, Telegram channels, and social engineering. Once installed, BadBazaar seeks to surveil the victim by intercepting SMS messages, performing screen recordings, and logging keystrokes on the device. Additionally, it can execute remote commands and download and install other malicious applications, further compromising the security of the affected device.
Detection coverage
- 2 YARA rules
Detection rules
- VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate (yara-rule)
- VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Apk.Badbazaar (report)
- ncsc.gov.uk — Ncsc Advisory Badbazaar And Moonshine Technical Analysis And Mitigations (report)
- ncsc.gov.uk — Ncsc Advisory Badbazaar And Moonshine Guidance (report)
- ncsc.gov.uk — Ncsc Partners Share Guidance For Communities At High Risk Of Digital Surveillance (report)
- lookout.com — Badbazaar Surveillanceware Apt15 (report)