How a Fake Bahrain Civil-Defense App Turns a Phone Into a Li...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://dreamgroup.com/blog/how-a-fake-bahrain-civil-defense-app-turns-a-phone-into-a-listening-post
• Blog Title: How a Fake Bahrain Civil-Defense App Turns a Phone Into a Listening Post
• Suggested Section: Mobile Pentesting > Android Applications Pentesting, with cross-references to Basic Forensic Methodology > Android Malware Post-Exploitation and Phishing Methodology > Mobile Phishing Malicious Apps

🎯 Content Summary

Overview

Published on July 20, 2026, this Dream Research Labs analysis documents a fake Android civil-defense application impersonating Bahrain Civil Defence, Bahrain's Ministry of Interior, the Information & eGovernment Authority, and UNDRR. Researchers analyzed the sample statically on July 17, 2026, without executing the APKs or decrypted DEX files and without contacting command-and-control or delivery infrastructure.

The campaign does not exploit a CVE. Instead, it combi...

🔧 Technical Details

Trusted-application impersonation and permission coercion: Clone a trusted application-store or government page, add fabricated reputation indicators and urgent safety messaging, and deliver a sideloaded APK. The application can then use a WebView JavaScript bridge to guide victims through VPN approval, unknown-source installation, accessibility, battery exemption, OEM autostart, default SMS/dialer roles, contacts, and SMS permissions. No software vulnerability is required: legitimate privileges are obtained through a trusted pretext and provide surveillance capabilities comparable to an exploit-based compromise.

Selective VPN blackhole: Establish an Android VPN with realistic addresses, DNS servers, and default IPv4/IPv6 routes, while excluding attacker-controlled packages and any communication applications needed to preserve the lure. Read packets from the TUN interface but deliberately return no processed packets for forwarding. Most a...

🤖 Agent Actions

Updated src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md.

Added concise new coverage for:

• selective VpnService blackhole coercion during malicious install/setup
• early Application.attachBaseContext() encrypted asset unpacking with reflective DexPathList injection

Also added the Dream blog URL to the file’s ## References section.

I did not update other files because the rest of the blog’s techniques were already substantially covered elsewhere in HackTricks and would have been redundant.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://dreamgroup.com/blog/how-a-fake-bahrain-civil-defense-app-turns-a-phone-into-a-listening-post

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting, with cross-references to Basic Forensic Methodology > Android Malware Post-Exploitation and Phishing Methodology > Mobile Phishing Malicious Apps".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge