Chinese spyware ‘EagleMsgSpy’ exposed

Cybersecurity researchers at U.S.-based firm Lookout have uncovered a sophisticated Chinese spyware tool, EagleMsgSpy, designed to covertly collect sensitive data from Android devices.

The discovery was revealed on Wednesday at the Black Hat Europe conference, where the firm detailed how the spyware has been operational since at least 2017.

Kristina Balaam, a senior intelligence researcher at Lookout, explained that the spyware has been deployed extensively by public security organizations in mainland China to gather a wide array of information from targeted devices.

These include private data such as call logs, contacts, GPS locations, bookmarks, and messages accessed through third-party applications like Telegram and WhatsApp.

A manual obtained by Lookout describes EagleMsgSpy as a “comprehensive mobile phone judicial monitoring product.”

The spyware is capable of obtaining real-time data from a suspect’s device through remote network control, allowing it to monitor all mobile phone activities without the user’s knowledge.

READ ALSO: Microsoft deepens AI-driven cybersecurity focus as threats intensify

Balaam emphasized that her team has “high confidence” in attributing the development of EagleMsgSpy to Wuhan Chinasoft Token Information Technology, a private Chinese technology company.

This conclusion stems from infrastructure overlaps that link the tool’s developers to public security bureaus in China. These bureaus serve as local policing entities, underscoring the spyware’s use in state-sponsored surveillance initiatives.

The Lookout team has acquired multiple versions of EagleMsgSpy, illustrating its evolution and continued use over the years.

Balaam noted that the spyware’s deployment raises significant concerns about the widespread surveillance capabilities being employed, potentially extending beyond law enforcement into broader misuse.

The disclosure has amplified calls for stronger cybersecurity measures to counter spyware threats, particularly as such tools increasingly target mobile devices—the primary medium for communication and data storage in modern society.