Dark Caracal global mobile espionage campaign

On 18 January 2018, the Electronic Frontier Foundation (EFF) and mobile-security firm Lookout published Dark Caracal: Cyber-espionage at a Global Scale, exposing one of the first publicly documented nation-state mobile-surveillance campaigns. The operators had stolen hundreds of gigabytes of data from thousands of victims across more than 21 countries — and researchers traced the command infrastructure to a building belonging to Lebanon's General Directorate of General Security (GDGS) in Beirut.

What happened

Dark Caracal relied primarily on social-engineering and phishing rather than expensive zero-day exploits. Victims were lured — often via Facebook groups, WhatsApp messages, and watering-hole pages — to fake app-store portals that served trojanized Android applications impersonating popular secure-messaging apps such as Signal, WhatsApp, Telegram, and Threema. The repackaged apps still functioned normally but bundled a custom implant Lookout named Pallas.

Once installed, Pallas could exfiltrate text messages, call logs, contacts, photos, browsing history, and account credentials; silently record audio; capture the camera; and harvest WhatsApp and other chat databases. The implant could also send attacker-controlled SMS messages to spread further. On the desktop side, the actor reused well-known tooling including Bandook and FinFisher-adjacent components, plus CrossRAT, a cross-platform Java RAT capable of infecting Windows, macOS, and Linux.

Impact

• Thousands of victims across 21+ countries, including Lebanon, Qatar, Saudi Arabia, the United States, France, Germany, Russia, China, and Nepal.
• Targets included military personnel, government officials, activists, journalists, lawyers, and educational institutions.
• Hundreds of gigabytes of stolen data — legal documents, audio recordings, chat logs, photos, and full browsing histories — much of it found on a misconfigured, internet-exposed server, which is partly how researchers mapped the operation.

Attribution

EFF and Lookout linked the campaign to the GDGS after correlating the malware's command-and-control servers with Wi-Fi networks and IP addresses physically located inside a GDGS office in Beirut. The researchers were careful to note they could not prove whether this reflected official GDGS policy or the work of a rogue insider, but the geolocation evidence was direct. The same infrastructure showed overlap with other nation-state activity, hinting at shared or commercially rented attack tooling.

Why it matters

Dark Caracal demonstrated that a persistent, global mobile-espionage operation could be run cheaply, without zero-days, by leaning on trojanized apps and human deception. It was among the first campaigns to put a specific government intelligence agency at the center of large-scale Android surveillance, and it foreshadowed the mercenary-spyware era (NSO Group's Pegasus, etc.) by showing how lightly resourced state actors could achieve mass mobile compromise. The operators' sloppy server hygiene — leaving terabytes of loot publicly reachable — also became a teaching case in attribution through operational-security failures.