--- title: "Morpheus Spyware: a fake Android application used for smartphone surveillance" description: The Android spyware Morpheus relies on sophisticated social engineering to infect its targets and spy on their activities. image: https://blog.pradeo.com/hubfs/Template%20article%20(27)-1.png --- [![pradeo\_logo\_color](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_color.png?width=220&height=33&name=pradeo_logo_color.png "pradeo_logo_color")](https://pradeo.com) - Solutions - [Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Secure Private Store](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Mobile Application Compliance Audit](https://pradeo.com/en/solutions/mobile-application-security/application-compliance-audit/) - [Runtime Application Self Protection](https://pradeo.com/en/solutions/mobile-application-security/rasp/) - [Shielding](https://pradeo.com/en/solutions/mobile-application-security/application-shielding/) - [Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - Use cases - [Cybersecurity in MDM/ UEM](https://pradeo.com/en/use-cases/cybersecurity-in-mdm-uem/) - [Securing mobile devices](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Securing Mobile Applications](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - [Malware / leakware protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Phishing protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Ensuring compliance for applications](https://pradeo.com/en/compliance/) - [Ensuring compliance for mobile fleet](https://pradeo.com/en/compliance/) - [Securing BYOD](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Become partner](https://pradeo.com/become-partner/) - Resources - [Solution briefs](https://pradeo.com/en/resources/?solution-briefs) - [Customer Cases](https://pradeo.com/en/resources/?customer-cases) - [Integration briefs](https://pradeo.com/en/resources/?integration-briefs) - [White Papers](https://pradeo.com/en/resources/?white-papers) - [Analyst reports & guides](https://pradeo.com/en/resources/?analyst-reports-guides) - [On demand webcast](https://pradeo.com/en/resources/?webcasts-on-demand) - [About us](https://pradeo.com/en/about/) - [Blog](https://blog.pradeo.com/) - [Contact](https://pradeo.com/contact/) - en - [**FR**](https://blog.pradeo.com/fr) - [**DE**](https://blog.pradeo.com/de) ### Topics - Select a Topic ### Stay up to date SUBSCRIBE TO OUR BLOG ### Stay up to date [Security Alert](https://blog.pradeo.com/topic/security-alert) [News](https://blog.pradeo.com/topic/news) # Morpheus Spyware: a fake Android application used for smartphone surveillance ![Picture of Clara Campos](https://blog.pradeo.com/hubfs/1711636314862%20(1).jpg) By [Clara Campos](https://blog.pradeo.com/author/clara-campos) on May, 12 2026 [mailto:?subject=Take%20a%20look%20at%20this%20article](mailto:?subject=Take%20a%20look%20at%20this%20article) ![](https://blog.pradeo.com/hubfs/Template%20article%20(27)-1.png) A new Android spyware has been uncovered by [Osservatorio Nessuno](https://osservatorionessuno.org/blog/2026/04/morpheus-a-new-spyware-linked-to-ips-intelligence/), an Italian digital rights organisation. Named Morpheus, this spyware stands out for its remarkably simple yet effective approach: rather than exploiting costly technical vulnerabilities, it relies on sophisticated social engineering to get its targets to install the spyware on their Android devices themselves. ## A simple but effective attack method In the case documented by the researchers, the attack begins with the [deliberate blocking of the target's mobile data](https://www.androidheadlines.com/2026/04/morpheus-android-spyware-whatsapp-account-trick.html) by their own telecom provider, at the request of the operation's sponsors. Cut off from connectivity, the victim receives an SMS prompting them to install an application to "restore their connection" or "update their phone". According to Osservatorio Nessuno, this mechanism, disrupting a service to push the target into installing the application, is the standard approach for low-cost spyware, although it can take other forms. Once installed, Morpheus abuses Android's accessibility permissions to read screen content, interact with applications and take control of the device. It displays a fake update screen while silently granting itself all necessary permissions in the background. The spyware also disables antivirus software present on the device and enables wireless debugging to maintain persistence. But Morpheus's most striking technique targets WhatsApp. The spyware displays a fake biometric screen mimicking the application, asking the victim to verify their identity. When the victim places their finger on the sensor, they unknowingly authorise the addition of a linked device to their WhatsApp account, giving the attacker complete, real-time access to all their messages and contacts. Beyond WhatsApp, Morpheus can also record audio and video, take screenshots, exfiltrate files stored on the device and erase its own traces.   ## Who is behind Morpheus [Osservatorio Nessuno researchers](https://osservatorionessuno.org/blog/2026/04/morpheus-a-new-spyware-linked-to-ips-intelligence/) have linked the spyware to IPS, an Italian company specialising in lawful interception technology for over 30 years, operating in more than 20 countries and counting several Italian police forces among its clients. Morpheus is classified as a "lawful interception" surveillance tool, designed for use by government agencies and law enforcement, which explains how the operation's commanders can leverage formal agreements with telecom operators to target their victims.   ## A Commercial Spyware Market That Is Industrialising Morpheus is not an isolated case. IPS joins a growing list of commercial spyware vendors exposed in recent years: CY4GATE, eSurv, RCS Lab, and most recently SIO. In April 2026, WhatsApp notified around [200 users who had installed a fake version of the application](https://techcrunch.com/2026/04/24/another-spyware-maker-caught-distributing-fake-android-snooping-apps/) containing spyware linked to SIO. In 2025, a professional mobile device has an average of [15 malicious applications](https://pradeo.com/en/form/mobile-security-report-2026/), up from 9 in 2023. These spyware tools do not necessarily require advanced technology, unlike [Pegasus](https://blog.pradeo.com/pegasus-analysis-recommendations) or [Graphite](https://blog.pradeo.com/graphite-spyware-a-new-case-of-mobile-espionage), which exploit costly and sophisticated zero-click vulnerabilities. On the contrary, Morpheus illustrates the emergence of a category of "low cost" spyware, technically simpler but just as invasive, that leverages privileged access to infrastructure and operators to deploy particularly effective social engineering.    ## How Pradeo Protects Against This Type of Threat Morpheus's attack method exploits several weaknesses in mobile device security. [Pradeo Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) addresses each of them. - **Malicious application detection.** Pradeo detects malicious applications installed on devices, including those installed outside official stores via sideloading, exactly the infection mechanism used by Morpheus. The solution identifies suspicious behaviours before the application can access device data. - **Permission abuse detection.** The solution identifies applications that request excessive permissions or abuse Android's accessibility services, the core mechanism exploited by Morpheus to take control of the device. - **Risky configuration detection.** Pradeo detects devices whose configuration increases vulnerability to attacks: developer mode enabled, wireless debugging enabled, unknown sources authorised for application downloads. These are exactly the vectors exploited by Morpheus to maintain persistence and weaken device security. - **SMS phishing protection.** The phishing SMS is the entry point of the Morpheus attack. Pradeo detects and blocks smishing attempts, preventing the user from clicking on the malicious link before infection occurs. ## A Warning Sign for Organisations Morpheus is a reminder that the most effective mobile threats are not always the most technically sophisticated. A "low cost" spyware capable of disabling mainstream antivirus solutions and spying on a device raises the question of what type of protection is truly needed on mobile. Traditional signature-based detection is not sufficient against threats designed to bypass it. ###### About The Author [More from this author](https://blog.pradeo.com/author/clara-campos) ![](https://blog.pradeo.com/hs-fs/hubfs/1711636314862%20(1).jpg?height=100&name=1711636314862%20(1).jpg) ###### Clara Campos #### Recommended articles [![Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/hubfs/Template%20article%20(34).png)](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) ###### [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) \- June 30, 2026 [![2026 World Cup: Cyberattacks Target Fans' Mobile Devices](https://blog.pradeo.com/hubfs/Template%20article%20(31)-1.png)](https://blog.pradeo.com/2026-world-cup-cyberattacks-target-fans-mobile-devices) ###### [2026 World Cup: Cyberattacks Target Fans' Mobile Devices](https://blog.pradeo.com/2026-world-cup-cyberattacks-target-fans-mobile-devices) \- June 11, 2026 [![Signal: a phishing campaign targets users' backups](https://blog.pradeo.com/hubfs/Template%20article%20(30)-1.png)](https://blog.pradeo.com/signal-a-phishing-campaign-targets-users-backups) ###### [Signal: a phishing campaign targets users' backups](https://blog.pradeo.com/signal-a-phishing-campaign-targets-users-backups) \- June 4, 2026 #### Recommended articles ### Popular articles ### Stay up to date ### Recent articles ### Articles récents [Fence integrates Pradeo's technology to secure its clients' mobile fleets](https://blog.pradeo.com/fence-integrates-pradeos-technology-to-secure-its-clients-mobile-fleets-1) \- 12 May, 2026 [RedHook: the banking trojan that grants itself system-level access on Android](https://blog.pradeo.com/redhook-the-banking-trojan-that-grants-itself-system-level-access-on-android) \- 12 May, 2026 [What Google's latest report reveals about mobile threats](https://blog.pradeo.com/what-googles-latest-report-reveals-about-mobile-threats) \- 12 May, 2026 [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) \- 12 May, 2026 [Vibe Coding: when AI-generated code multiplies vulnerabilities](https://blog.pradeo.com/vibe-coding-when-ai-generated-code-multiplies-vulnerabilities) \- 12 May, 2026 ### Topics - [Mobile Security (56)](https://blog.pradeo.com/topic/mobile-security) - [Mobile Application Security (46)](https://blog.pradeo.com/topic/mobile-application-security) - [Expertise (31)](https://blog.pradeo.com/topic/expertise) - [Security Alert (30)](https://blog.pradeo.com/topic/security-alert) - [Cybersecurity (29)](https://blog.pradeo.com/topic/cybersecurity) - [News (28)](https://blog.pradeo.com/topic/news) - [Partners (25)](https://blog.pradeo.com/topic/partners) - [Corporate (12)](https://blog.pradeo.com/topic/corporate) - [Events (4)](https://blog.pradeo.com/topic/events) - [Actualité (2)](https://blog.pradeo.com/topic/actualité) - [predictions (2)](https://blog.pradeo.com/topic/predictions) - [cyberattack (1)](https://blog.pradeo.com/topic/cyberattack) see all [![New Call-to-action](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f) ### Get in touch with mobile security experts [Contact us](https://www.pradeo.com/en-US/contact-us) [![](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_white_square.png?width=90&height=74&name=pradeo_logo_white_square.png)](https://pradeo.com) European leader in mobile security, Pradeo protects business mobile devices and applications. [Read More](https://www.pradeo.com/en-US/) - [Resources](https://www.pradeo.com/en-US/pradeo-ressources#white_papers) - [UEM security](https://www.pradeo.com/en-US/uem-mdm-security) - [Use cases](https://www.pradeo.com/en-US/pradeo-ressources#use-case) - [Data protection](https://www.pradeo.com/en-US/mobile-data-privacy-regulation) - [Contact us](https://www.pradeo.com/en-US/contact-us) - [Mobile Threat Defense](https://www.pradeo.com/en-US/mobile-threat-defense) - [Mobile Application Security Testing](https://www.pradeo.com/en-US/application-security-testing) - [In-App Protection](https://www.pradeo.com/en-US/in-app-protection) - [Secure Private Store](https://www.pradeo.com/en-US/private-app-store) - [Mobile Threat Intelligence](https://www.pradeo.com/en-US/mobile-threat-intelligence#perso-threat-intelligence) ![email.svg](https://cdn2.hubspot.net/hubfs/3067823/awwal/email.svg "email.svg") [contact@pradeo.com](mailto:contact@pradeo.com) Copyright @ 2022. All Right Reserved. - - - ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Clara Campos" }, "dateModified" : "May 12, 2026, 9:16:22 AM", "datePublished" : "2026-05-12 09:16:22", "description" : "The Android spyware Morpheus relies on sophisticated social engineering to infect its targets and spy on their activities.", "headline" : "Morpheus Spyware: a fake Android application used for smartphone surveillance", "image" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Template%20article%20%2827%29-1.png" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Logo%20Pradeo%20D%C3%A9grad%C3%A9%20Long%20Couleurs.svg" }, "name" : "Pradeo" } } ```