New Delhi, March 3 (NationPress) The AI-powered cybersecurity company CloudSEK has revealed a deceptive SMS spoofing scheme that is disseminating a compromised version of Israel's official "Red Alert" emergency mobile app. This malicious activity is taking advantage of public anxiety amid the escalating Israel-Iran conflict.

As reported by the firm, cybercriminals are distributing a counterfeit Android application through targeted SMS phishing messages, enticing users to sideload an APK file under the guise of an urgent wartime notification.

This harmful application mimics the official alert system of Israel's Home Front Command and replicates its user interface while incorporating spyware functionalities.

Unlike the genuine app available on the Google Play Store, the compromised version requests dangerous permissions such as access to SMS messages, contacts, and precise location tracking, as stated by CloudSEK.

Once installed, the malware can intercept SMS messages, collect contact information, and continually monitor GPS locations.

CloudSEK highlighted that the malware employs sophisticated evasion tactics, including signature spoofing to resemble the original app's 2014 signing certificate and installer spoofing to create the illusion that it was downloaded from the Play Store.

The application dynamically loads concealed payloads and executes a multi-step infection sequence to evade standard security protocols.

During their runtime analysis, researchers found that the malware triggers background processes to observe permission approvals.

Data gathered from infected devices is stored locally and transmitted via HTTP POST requests to infrastructure controlled by the attackers, including the domain api.ra-backup[.]com.

The campaign utilizes cloud-based infrastructure, with IP addresses associated with AWS and Cloudflare services, complicating backend attribution.

CloudSEK cautioned that this spyware presents both digital and physical security dangers. Real-time location tracking during active air strikes could expose civilian movement patterns, while SMS interception might allow attackers to circumvent two-factor authentication and target high-profile individuals.

The company recommends that users refrain from downloading applications from unverified sources and only obtain emergency apps from official platforms. In case of suspected malware infection, they advise immediate device isolation and a comprehensive factory reset to avert further data breaches.