TF-MAL-apk.flexispy

Description

ThreatFox malware family `apk.flexispy`. Printable name: FlexiSpy.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• FlexiSpy, Software S0408 | MITRE ATT&CK®
  web:attack.mitre.org

  FlexiSpy is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version. [1] [2] FlexiSpy markets itself as a parental control and employee monitoring application. [3]

  2026-05-22 01:17 UTC
• MalwareBazaar | Flexispy
  web:bazaar.abuse.ch

  Malware samples associated with tag Flexispy MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with Flexispy . Database Entry

  2026-05-22 01:17 UTC
• FBI warns of ATM jackpotting surge | Cybernews
  web:cybernews.com

  The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.

  2026-05-22 01:17 UTC
• FlexiSpy (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the FlexiSpy malware family including references, samples and yara signatures.

  2026-05-22 01:17 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 01:17 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 01:17 UTC
• Remediate Threats Quickly and Confidently - CrowdStrike
  web:www.crowdstrike.com

  Remediate faster Execute built-in commands or custom scripts to easily carry out complex remediation actions on any managed endpoint remotely. Connect to and quickly isolate the impacted endpoint, then remove malicious files to immediately shut down the attack.

  2026-05-22 01:17 UTC
• Flexispy.B - F-Secure
  web:www.f-secure.com

  Removal Manual action If you feel you want to remove Flexispy from your device, you can do that by doing the following: Scan the phone and remove any components of the malware Reboot the phone to remove memory resident components After removing using F-Secure Mobile Anti-Virus, there will be remaining files from the spyware on the telephone.

  2026-05-22 01:17 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-22 01:17 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.