LightSpy Hackers Target Indian Apple Device Users To Steal Sensitive Data

Hackers target Apple device users because they are perceived to be of higher social classes. This leads to targets who are richer than others and who can possibly provide more money to the hackers in one way or another.

Besides this, Apple’s ecosystem is interconnected, which means it has various points from which hackers can enter, leading to the compromise of accounts and devices.

BlackBerry cybersecurity researchers recently discovered that LightSpy hackers are actively targeting Indian Apple device users to steal sensitive data.

LightSpy Hackers & Their Targets

LightSpy is a modular spying toolkit that can steal victims’ personal information, such as actual GPS coordinates or VOIP calls.

This new threat is dangerous because it allows hackers to follow targets with an exceptional degree of accuracy, expanding the potential impacts of this expansive surveillance on high-profile victims in politically sensitive regions.

LightSpy has an extensive spying capacity and can be used to monitor device data, QQ messenger content, WeChat messages, Telegram chats, and WeChat Pay history.

Document
Stop Advanced Phishing Attack With AI

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

This highly effective software program returned during escalated regional hostilities after its 2020 operations had focused on Hong Kong-oriented news websites for distribution. 

The threat group, based in servers located in Russia, China, and Singapore, is very interested in monitoring victims involved in clashes of interests across South Asia.

This again highlights how even the slightest flare-ups pose a constant danger to the people involved there.

The motives behind this campaign and the geopolitical implications for Southern Asia that it has raised become sources of worry because of suspected links with China.

Hyper-targeted attacks like these may impact only a tiny fraction of individuals, such as journalists, activists, or politicians, but at the same time can be seen as a worldwide threat.

Tech companies have recently pointed out the danger of state-sponsored election tampering. According to Apple, powerful mercenary spyware is one of the most complex digital threats in existence.

When the vulnerability is detected on news websites specifically reporting Hong Kong issues, the infection usually starts. 

Loader’s signature (Source – BlackBerry)

The attack advances with an initial implant, which collects device data and downloads successive stages.

These include LightSpy, which is the core implant, and special spying plugins.

The Loader starts by loading both the LightSpy kernel in encrypted form and decrypted form, BlackBerry said.

The recent campaign uses “F_Warehouse” framework that has various functionalities including file exfiltration, network reconnaissance, and audio recording. 

Besides this, executing shell commands can give full control to an attacker.

While the LightSpy maintains communication with its server as well as with an administrative panel that helps enhance its probable origin.

Recommendations

Here below we have mentioned all the recommendations:-

  • Exercise heightened vigilance
  • Use of Lockdown mode
  • Use highly secure voice and messaging solutions
  • Review the latest threat intelligence
  • Create an incident response plan
  • Update your devices
  • Use a passcode
  • Enable 2FA
  • Beware of unofficial software
  • Password hygiene
  • Think before you click
  • Restart your phone often

Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

2 days ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

2 days ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

2 days ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

2 days ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

2 days ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

2 days ago