Cybersecurity researchers have discovered a spyware campaign that is targeting Uyghurs by “masquerading” as Android apps including messaging services, prayer time apps and dictionaries, according to a new report by the cloud security firm Lookout. The spyware, which researchers say is connected to a Chinese government-backed hacking group, can be used to track people who use services that may be considered a “pre-crime” or are seen by China as indications that someone is engaging in or will engage in religious extremist or separatist activities. “Pre-crime” activities include using a virtual private network (VPN) or sharing any kind of religious content and can lead to being detained in a re-education camp. The surveillance campaign primarily targets Uyghurs in China, according to the report, but there is also evidence that those behind the campaign were looking to target Uyghurs in Muslim-majority countries like Afghanistan or Turkey. Turkey is home to the largest Uyghur diaspora outside of Central Asia with an estimated 50,000 Uyghurs living there. China’s mass surveillance apparatus and its targeting of Uyghurs has been well documented in the past few years. Several Chinese surveillance and camera companies have been placed on the US entity list for complicity in human rights violations. Some of these firms have filed for patents for, developed or planned to develop features that would allow them to detect or set up alerts when someone who is Uyghur is detected. The UN has also found that China is responsible for “serious human rights violations” against Uyghurs in Xinjiang. In a statement to Bloomberg, Liu Pengyu, spokesperson at the Chinese embassy in Washington, said: “We oppose wild guesses and malicious slurs against China,” and that the country opposes “all forms of cyber-attacks”. Researchers say many of the apps with this spyware, which they have named Badbazaar, collect device data including location; contacts; call logs; wifi information; and can also record phone calls and take pictures. The researchers also found that newer iterations of Moonshine, an Android exploit first discovered in 2019 by the University of Toronto’s research group Citizen Lab, implement spyware in popular apps including WhatsApp and Telegram as well as “versions of Muslim cultural apps, Uyghur-language tools, or prayer apps”. The Android apps mimicking existing services are typically found on unofficial app stores because Google Play is blocked in China, according to the report, and also spread through messaging services including Telegram. Kristina Balaam, a staff threat intelligence researcher at Lookout, said this was one of the more sophisticated “malware families” they had seen because in addition to collecting extensive data on people, the apps they are either custom-building or infecting are fully functional. “Even cases where the threat actor has built a custom application, like a third-party app store that they’re claiming will let you download, say a legal language dictionary or other translation tools or prayer applications, they’re actually fully built-out applications,” Balaam said. “Or in the case of a Trojanized version of Telegram, you can log in with your actual Telegram account because it truly is Telegram,” she continued. “It has just been Trojanized by the threat actor to also install surveillance functionality to your device and collect information on who you’re speaking to, your contacts, photos and GPS data.” The threat actors – malicious groups or individuals responsible for the security threats – are able to do this by using “the same source code from the legitimate app” to build the fake app, “it still talks to the server and lets you sign in,” Balaam said. A Telegram spokesperson, Remi Vaughn, said Telegram had not been compromised and that the report was referring to malicious apps pretending to be official. “It is not possible for Telegram or any app to protect users if they download apps from unofficial app stores or third-party websites,” Vaughn said in a statement. Balaam agreed that there was little companies can do to shut down these threat actors “because they tend to be quite nimble with how they pivot to new platforms to distribute this malware”. “So I think one of the things that unfortunately we just have to do as consumers is be especially wary of the applications that we’re downloading,” she said. “It’s hard if you’re within China because you don’t have access to some of the official app stores like Google Play. Otherwise, it’s pretty important to not download applications from social media, or applications that are being shared through something like one of these Telegram channels.”