Ongoing EvilEye Campaigns Targeting CCP Adversaries

The talk follows an ongoing campaign run by a threat actor tracked as Evil Eye, also known as Bamboo, which has been active for several years. Unlike intrusions aimed at specific people, this group appears to pursue whole communities at scale. The speaker groups its Android malware into three related families and notes that some variants also have iOS support.

Most of the session covers how the operators reach victims rather than malware internals. Modified copies of popular apps are spread through cracked-app forums, cloud-hosted download links, lure websites, social media accounts and large Telegram groups, often in translated versions aimed at minority-language speakers. One trojanized Signal build can silently pair a victim's phone with an attacker-controlled desktop client and can route traffic through a chosen proxy. JavaScript profiling on lure sites suggests visitors are fingerprinted, possibly to decide who receives an exploit, though no delivery was observed.

Evidence for iOS is indirect, including leftover endpoints in a trojanized app and an app that was later removed from a store. The speaker found the operation efficient and largely automated, and noted the actor was still active but had recently released no new apps. Asked about attribution, the speaker had no firm answer beyond the targeting pattern. The takeaway is that defenders serving targeted communities should treat sideloaded and translated apps as a serious risk.