Kaspersky Lab specialists have detected over 3,000 attacks on Android users in Russia using a new spyware Trojan called LunaSpy. The first cases of this malware were recorded in February 2025, but a sharp increase in attacks was observed in June and July.
Attackers distribute LunaSpy through messengers, disguising it as security applications for smartphones and financial services. After installation, the victim receives a notification about non-existent threats, which forces them to grant the necessary permissions supposedly to protect the device.
LunaSpy has many dangerous functions. It can record audio and video through the camera and microphone, track geolocation, record the screen, and monitor activity in messengers and browsers. In addition, the malware can steal passwords, SMS, call logs, and contacts. A fragment was also found in the code that allows stealing photos from the gallery, although this function has not yet been used.
Experts suggest that LunaSpy can be used not only for espionage but also for stealing money from users.
In Russia, 70% of mobile devices run on Android, which is about 60-70 million devices. The Trojan can also be installed on iPhones. But this is less likely, since LunaSpy is more often distributed among Android devices.
Earlier, in August 2024, Kaspersky Lab discovered another Trojan, LianSpy, which was also used for cyber espionage. However, LianSpy had a more limited nature of attacks, in contrast to the mass distribution of LunaSpy.
Read more on the topic:
Fraudsters create websites of non-existent cheap online stores