DragonDoll Spyware Targets Android Users in 26 Countries

Users from over 26 countries, including Russia, using Android devices, have been targeted by a new spyware program called DragonDoll.

Consensus

DragonDoll is a spyware program targeting Android devices.
The malware disguises itself as a Google Chrome update.
It spreads through fake websites mimicking official Chrome pages.
The attack affects users in more than 26 countries, including Russia.
The malware enables attackers to steal messages from messaging apps like Telegram and WhatsApp.
It can intercept passwords and PINs by overlaying fake input windows on legitimate apps.
The malware allows remote control of infected devices.
Experts recommend installing apps only from official stores like Google Play or RuStore.
Users should avoid clicking on links promoting new browser updates, VPNs, or certificates from untrusted sources.
Signs of infection include overheating, rapid battery drain, and increased mobile data usage.
If infected, users should disconnect the device from the network and perform a factory reset.
After reset, users should change passwords on critical accounts and enable two-factor authentication.

The malware was detected in 150 samples over two months by Positive Technologies analysts. — vedomosti
In June, the FSB reported a scheme involving international IT corporations to secretly extract data, eavesdrop on calls, and conduct audio and video surveillance near electronic devices. — vedomosti
Starting March 1, 2027, Russian banks will block transactions if malware is detected on a user's device, requiring additional confirmation for any payment. — vm
The malware requests special permissions for users with poor vision, which are exploited to gain full device access. — vedomosti