Beware – Iran-linked fake VPN apps found to spy on Android users

• Researchers found a new spyware campaign mainly targeting Iranian Android VPN users
• DCHSpy is leveraged by the Iranian cyber espionage group MuddyWater, which is thought to have links with Iran's Ministry of Intelligence and Security
• The campaign started one week after the Israel-Iran conflict began, while VPN demand skyrocketed across the country

Researchers have discovered a new Iran-linked spyware campaign that mostly targets Android VPN users.

The team at security software provider, Lookout, found a new version of DCHSpy, an Android spyware that masquerades as legitimate VPN apps or other applications. This includes Starlink, a satellite internet connection service offered by SpaceX.

The malware campaign, according to experts' findings, was deployed by the hacking group MuddyWater only a week after the Israel-Iran conflict began – exactly when VPN demand skyrocketed in Iran as citizens looked for ways to bypass new internet restrictions.