The SpyMax Android spyware, distributed via a Telegram channel disguised as a humanitarian aid app, targeted Syrian army personnel by promising cash transfers while collecting sensitive military data. Qi An Xin’s mobile security team had already documented the lure in November 2023: SpyMax samples posing as the Syria Trust for Development app, a phishing form asking for rank, service location and family details, and indicators suggesting the campaign had been running since September 2023. The spyware could stream camera feeds, record audio, track location, keylog user input, and exfiltrate SMS, contacts, and call logs, effectively creating “live maps of force deployments” and compromising military operational status. By exploiting soldiers’ economic desperation through social engineering, attackers used this low-cost, off-the-shelf tool to systematically undermine the Syrian army’s infrastructure.
