Chinese Authorities Using Spyware to Monitor Android Devices

Chinese authorities have been using an advanced spyware tool called “EagleMsgSpy” to monitor Android devices in China, according to a report by US-based cybersecurity firm Lookout. Operational since at least 2017, the spyware has been used by public security bureaus across China to gather vast amounts of data, including call logs, text messages, GPS location, and encrypted communications from apps such as Telegram and WhatsApp.

These findings, first shared by Lookout at the Black Hat Europe conference, highlight the increasing use of digital surveillance tools in government operations. Kristina Balaam, a senior intelligence researcher at Lookout, explained that the spyware allows operators to initiate real-time recordings, monitor device activity, and block specific communications through an administrative panel.

The spyware is installed manually — installation methods include USB connections and QR codes, according to the findings.

The infrastructure supporting EagleMsgSpy shows strong links to public security bureaus in cities like Yantai and Gui Yang. Researchers also connected the spyware’s command-and-control servers to other surveillance tools like CarbonSteal and PluginPhantom, with the former being used in previous campaigns targeting minority groups, including Uyghurs and Tibetans.

Internal documents obtained by the researchers suggest that an iOS variant of the spyware also likely exists, but has yet to be uncovered.

Balaam noted that there are signs that Chinese authorities wish to monitor any visitors to China, not just Chinese citizens. She stated: “I think if it was just about domestic surveillance, they would stand up their infrastructure in some place that we couldn’t access from North America. I think it gives us a bit of insight into the fact that they’re hoping to be able to track people if they leave, whether they are Chinese citizens, or not.”

Recently, concerns about China's digital operations have intensified after reports of Chinese cyberattacks on UK democratic institutions and a breach in Fortinet systems by Chinese hackers. Together, these revelations highlight a pattern of increasing cyber aggression from Beijing.