Mercenary Cyber Surveillance: Indian Hack-for-Hire Group Targets Android and iCloud Backups

Background

This activity reflects the commercial ‘hack-for-hire’ model: a mercenary group sells targeted offensive surveillance to private clients, corporate actors or brokers, rather than acting on state geopolitical tasking. Public reporting on the April 2026 campaign links it to the Indian hack-for-hire ecosystem – assessed as a possible offshoot of the firm Appin, with RebSec named as a possible suspect – building on Reuters’ 2022-2023 investigations and Google Threat Analysis Group’s tracking of hack-for-hire firms in India, Russia and the UAE.

The operation is deliberately cross-platform. Against Android it deploys custom spyware (publicly reported as ProSpy) that masquerades as popular messaging and communication apps such as Signal, WhatsApp, Zoom, ToTok and Botim. Against iPhone users – where remote exploitation is hard – it sidesteps the device entirely by phishing Apple ID credentials and harvesting iCloud backups, obtaining the target’s full history without ever touching the phone.

What we observed

The campaign splits into two complementary avenues, both aimed at total visibility into a target’s digital life:

• Android implant: spyware masquerading as trusted apps (e.g. Signal, WhatsApp, Zoom, ToTok, Botim) tricks the victim into granting Accessibility Services or device-admin access, then collects SMS, contacts, GPS location and microphone audio.
• iCloud backup theft: fake Apple ID login pages harvest credentials, and real-time reverse-proxy relays or social-engineering prompts capture 2FA tokens so the operator can authenticate as the victim.
• Bulk cloud extraction: once authenticated, backup-recovery tooling copies the entire iCloud sync store – messages, photos, notes and app databases – down to attacker infrastructure.
• Covert exfiltration: the Android payload compresses harvested data locally and beacons to C2 over SSL-wrapped channels with hard-coded hostnames designed to blend into normal web traffic.

Dual-pronged surveillance flow

Two paths, one goal: if the phone is hard to hack, steal the cloud backup instead.

Attribution

Public reporting associates this campaign with the Indian hack-for-hire ecosystem and assesses it as a possible offshoot of the firm Appin, with RebSec named as a possible – not confirmed – suspect. Because mercenary tooling is reused across many clients and targets, identifying the ultimate paying client is a hard forensic problem (‘attribution laundering’); treat operator and client attribution as tentative and confirm against primary reporting and internal telemetry.

Hack-for-hire turns surveillance into a service – the buyer never builds a single exploit, and the tooling launders away who paid for the operation.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Detection

Copy-ready hunting query:

# iCloud/Apple ID account defense: review trusted-device and sign-in activity for the account
# (appleid.apple.com > Devices) - flag unfamiliar devices, new-country logins, and just-added trusted numbers

# Proxy/DNS hunt: lookalike Apple/iCloud/Google lure domains (typosquats)
# e.g. patterns reported by Google TAG such as 'rnanage-icloud' or 'mail-goolge'
index=proxy OR index=dns
| eval susp=if(match(domain, "(?i)(icloud|apple|appleid|google|gmail).*(-|\.)(login|verify|secure|backup|support)|rnanage|goolge"), 1, 0)
| where susp=1
| stats count values(user) as users by domain

# Android (MDM/EDR): apps requesting high-risk permissions or sideloaded from unknown sources
# Flag packages requesting Accessibility Services, SMS read, microphone and background location
# that were installed outside the official store.

Recommendations

• Enroll high-risk users in hardware-backed 2FA (FIDO2 security keys) instead of SMS or app codes – this defeats the real-time reverse-proxy phishing used to capture Apple ID 2FA.
• Enable Advanced Data Protection for iCloud so backups are end-to-end encrypted; even if account tokens are stolen, the backup contents remain unreadable to the attacker.
• Block sideloading via MDM and audit Android app permissions – immediately flag and remove non-store apps requesting Accessibility Services, SMS access, microphone or background location.
• Provide targeted phishing awareness for at-risk staff (fake Apple/Google login pages, 2FA-prompt social engineering) and monitor account sign-in and trusted-device changes for anomalies.