New Android spyware Morpheus linked to Italian surveillance firm

Osservatorio Nessuno uncovered Morpheus spyware spreading via fake Android apps to steal data, highlighting rising covert surveillance tools.

The non-partisan, non-religious, nonprofit organization Osservatorio Nessuno exposed a new spyware called Morpheus, distributed through fake Android apps posing as updates. Once installed, it can steal extensive data from the infected devices. The report shows strong demand from law enforcement and intelligence agencies, fueling a growing market of spyware vendors, many operating quietly outside public scrutiny.

Attackers used a typical low-cost spyware tactic: disrupt a service and trick the victim into installing a fake app to restore it. In this case, targets received an SMS linking to a site impersonating an ISP. The first stage, a dropper app, installs a hidden second-stage payload embedded within it. It checks if the payload is already present, then silently deploys it with minimal user awareness.

The second stage disguises itself as legitimate system components, using fake icons and names to appear trustworthy. It forces users to grant dangerous permissions, including Accessibility access, which allows it to read screens, interact with apps, and capture sensitive data.

“After granting Accessibility permissions, the spyware starts a Permission Workflow that creates an overlay with a fake update process and a fake reboot screen. In background, the workflow performs all the steps to grant all the needed permissions. This includes enabling Developer Options, turning on Wireless Debugging, and locally pairing to the ADB daemon.” reads the report published by the Osservatorio Nessuno. “Conveniently, during the fake update the app disables the touchscreen by setting FLAG_NOT_TOUCHABLE on the whole full-screen overlay, leaving the user partially unable to respond to the infection.”

The malware also gains persistence by restarting after reboot and can request device admin privileges, making removal difficult. Overall, it enables long-term, covert surveillance of the infected device.

The spyware abuses overlay windows and Accessibility features to take control of the device and bypass protections. Using the powerful SYSTEM_ALERT_WINDOW permission, it displays fake screens, such as updates or reboots, while secretly granting itself permissions in the background, even disabling touch input to limit user control. It can trick victims into approving actions like linking a WhatsApp account by showing a fake biometric prompt.

It also enables Wireless Debugging and connects to ADB to gain elevated privileges, silently granting itself sensitive permissions, disabling security protections like camera/mic indicators and Play Protect, and turning off antivirus tools.

“In the third phase the spyware disables a number of known Antivirus software, including Google’s own SafetyCore, Bitdefender, Sophos, Avast, AVG, Malwarebytes, along with a handful of smaller “cleaner/antivirus” apps popular on low end devices.” continues the report. “None of these requires root, and persists across reboots since the Android security model treats user’s installed anti-malware software like ordinary apps.”

Finally, it adjusts system settings across different Android versions to ensure persistence, avoid detection, and maintain full access to the device.

The analysis of the source code suggests an Italian origin for the spyware, based on language clues and references like “aprafoco” and “Gomorra.” The malware supports multiple languages and Android devices, showing broader targeting. Its infrastructure uses encrypted configs, Italian-hosted servers, and domains linked to small ISPs and obscure entities with generic details.

The researchers found ties between hosting providers, fake or opaque companies, and shared contacts. The phishing domain is registered to a small Italian firm with minimal activity and links to other questionable businesses. Overlapping financial and corporate connections suggest a network of related entities potentially supporting the spyware operation while masking its true ownership.

Osservatorio Nessuno concluded that the spyware is linked to IPS Intelligence, an Italian firm active for over 30 years in lawful interception technologies used by governments to monitor communications through telecom and internet providers.

“While IPS Intelligence is a well‑known commercial surveillance provider, this is, to our knowledge, the first report linking them to the distribution and operation of spyware.” concludes the report. “Morpheus is extremely invasive: it can record audio and video, silently pair a WhatsApp device, erase evidence, and deliberately weaken the security of the infected phone, among other malicious capabilities.”

The researchers did not provide details on how they isolated or identified the sample, so the exact collection and analysis process remains undisclosed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, spyware)