VERY IMPORTANT

Security Without Borders identified a new Android spyware platform we named Exodus, which is composed of two stages we call Exodus One and Exodus Two. We have collected numerous samples spanning from 2016 to early 2019. Instances of this spyware were found on the Google Play Store, disguised as service applications from mobile operators. Both the Google Play Store pages and the decoys of the malicious apps are in Italian. According to publicly available statistics, as well as confirmation from Google, most of these apps collected a few dozens installations each, with one case reaching over 350. All of the victims are located in Italy. All of these Google Play Store pages have been taken down by Google. Security Without Borders believes this spyware platform is developed by an Italian company called eSurv, which primarily operates in the business of video surveillance. According to public records it appears that eSurv began to also develop intrusion software in 2016.