A threat actor associated with cyberespionage operations since at least 2017 has been luring victims with fake VPN software for Android that is a trojanized version of legitimate software SoftVPN and OpenVPN.

Researchers say that the campaign was “highly targeted” and aimed at stealing contact and call data, device location, as well as messages from multiple apps.