Hamas-Linked Spyware Targets Israelis via Fake Emergency-Alert App Security researchers at Acronis Threat Research Unit (TRU) uncovered a cyberespionage campaign distributing spyware disguised as Israel’s official Red Alert rocket warning app. The attack, detected on March 1, leverages SMS phishing messages impersonating the Oref Alert service, urging recipients to install a malicious "update" via a shortened bit.ly link. The malware, attributed to the Hamas-aligned group Arid Viper (also known as APT-C-23, Desert Falcons, or Two-tailed Scorpion), bypasses Android security by spoofing Google Play certificates and installer sources. Once installed, it requests 20 permissions, including access to GPS location, SMS messages, contacts, and device accounts. The spyware also enables phishing overlays to intercept credentials and one-time passwords, while maintaining persistence through device reboots. Stolen data is transmitted to a remote command-and-control server. The campaign appears indiscriminate, with warnings issued by Israel’s National Cyber Directorate and major news outlets. Researchers note that such attacks often escalate during military conflicts, using emergency alerts as social engineering lures to gather intelligence. Previous operations by Arid Viper have targeted Israeli users across Android, iOS, and Windows platforms since at least 2013. The incident highlights the growing role of cyber operations as a parallel intelligence-gathering tool in geopolitical conflicts.