SpyNote
Aliases: CypherRat
- First seen
- 2016-11-01 00:00:00
- Malware type
- rat, keylogger, screen-capture, spyware, trojan
- Family
- Malware family
- Last IoC activity
- 2026-07-22 03:55:48
- Profile updated
- 2026-07-07 15:46:20
Targeted industries: financial-services technology-and-telecommunications retail-and-hospitality
Context
According to Cleafy, SpyNote abuses Accessibility services and other Android permissions in order to: Collect SMS messages and contacts list; Record audio and screen; Perform keylogging activities; Bypass 2FA; Track GPS locations.
Detection coverage
- 1 YARA rules
Detection rules
- SEKOIA_Apt_Spynote_Android_Dex_Strings (yara-rule)
Reports & references
- ti.qianxin.com — Blade Hawk The Activities Of Targeted The Middle East And West Asia Are Exposed (report)
- volexity.com — Storm Cloud Unleashed Tibetan Community Focus Of Highly Targeted Fake Flash Campaign (report)
- mp.weixin.qq.com — J A12Sox0K5Toyfaegbv W (report)
- cocomelonc.github.io — Aiya Mmd Book (report)
- intel471.com — China Cybercrime Undergrond Deepmix Tea Horse Road Great Firewall (report)
- intrinsec.com — Tlp Clear Prospero Proton66 Uncovering The Links Between Bulletproof Networks (report)
- intrinsec.com — Prospero Proton66 Tracing Uncovering The Links Between Bulletproof Networks (report)
- group-ib.com — Craxs Rat Malware (report)
- threatfabric.com — Spynote Rat Targeting Financial Institutions (report)
- threatfabric.com — Spynote Rat Targeting Financial Institutions (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Spynote (report)
- about.fb.com — Taking Action Against Hackers In Palestine (report)
- mp.weixin.qq.com — Mstwbmks0G3Et4Goji2Mwa (report)
- labs.k7computing.com — Spynote An Android Snooper (report)
- hunt.io — Caught In The Act Uncovering Spynote In Unexpected Places (report)
- bulldogjob.pl — 1200 An In Depth Analysis Of Spynote Remote Access Trojan (report)
- bleepingcomputer.com — Spynote Android Malware Infections Surge After Source Code Leak (report)
- fortinet.com — Android Spynote Moves To Crypto Currencies (report)
- civilsphereproject.org — Capturing And Detecting Androidtester Remote Access Trojan With The Emergency Vpn (report)
- medium.com — Spynote D7D0F31Ec697 (report)
- labs.k7computing.com — Spynote Targets Irctc Users (report)
- cleafy.com — Spynote Continues To Attack Financial Institutions (report)
- dti.domaintools.com — Newly Registered Domains Distributing Spynote Malware (report)
- docs.google.com — Edit (report)
- cryptax.medium.com — Android Spynote Bypasses Restricted Settings Breaks Many Re Tools 8791B3E6Bf38 (report)