HACKERS SPREAD FAKE RED ALERT ROCKET ALERT APP TO SPY ON ISRAELI USERS

Summary from the TLDR InfoSec newsletter

Acronis TRU discovered a trojanized Red Alert rocket warning app distributed via SMS, impersonating Israel's Home Front Command, attributed to Arid Viper (APT-C-23). Detected on March 1, the malicious APK requests 20 permissions, including 6 sensitive ones, harvesting GPS location, SMS/OTP content, contact lists, installed apps, and registered accounts, while using certificate spoofing to masquerade as a legitimate Google Play install. The campaign fits a broader pattern of geopolitical lure-based mobile spyware operations previously linked to the region, including a near-identical Red Alert exploit documented by Cloudforce One in October 2023.