TF-MAL-apk.spymax
📛 Threat Title
Malware family: SpyMax
Description
ThreatFox malware family `apk.spymax`. Printable name: SpyMax.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.spymax
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.spymax
IOC database
- Type
- domain
- Value
apk.spymax- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.spymax
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.spymax
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:community.gurucul.com
A variant of the Android-based Remote Access Trojan (RAT) known as SpyMax is currently being distributed through social engineering campaigns. Cybercriminals are targeting mobile users by spreading fake apps—such as counterfeit versions of Telegram or wedding invitation apps—via messaging platforms like WhatsApp.
-
web:cyberpress.org
Forensic analysis confirmed that the spyware is a refined variant of the notorious SpyMax /SpyNote family , known for its modular surveillance capabilities and deep device integration.
-
web:cybersecuritynews.com
This advanced variant of the SpyMax /SpyNote family targets Chinese-speaking users across mainland China and Hong Kong, exploiting Android Accessibility Services through polished social engineering techniques and deceptive UI elements to gain near-total control of victims' devices.
-
web:gbhackers.com
In early 2025, threat intelligence experts at Perplexity uncovered an advanced variant of the SpyMax /SpyNote family of Android spyware.
-
web:malpedia.caad.fkie.fraunhofer.de
SpyMax is a popular Android surveillance tool. Its predecessor, SpyNote, was one of the most widely used spyware frameworks.
-
web:malware.news
Threat intelligence experts at Perplexity uncovered an advanced variant of the SpyMax /SpyNote family of Android spyware, cleverly disguised as the official application of the Chinese Prosecutor's Office (检察院). This malicious software was targeting Chinese-speaking users in mainland China and Hong Kong in what appears to be a sophisticated cyber espionage campaign. Exploiting Android ...
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.pcrisk.com
The spyware can locate accounts linked to the device and potentially misuse them. In summary, SpyMax infections are a privacy concern that can lead to serious issues. Therefore, if it is known or suspected that this or other malware has already infected the device, immediate removal is strongly advised.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.