Spyware variants MOONSHINE and BADBAZAAR are being used to target mobile devices of individuals around the world. Two new advisories, released on 9th April 2025 by the National Cyber Security Centre (NCSC) together with BfV and other agencies in Australia, Canada, Germany, New Zealand and the United States give details about how malicious cyber actors are using spyware in manipulated apps to target individuals who are connected to topics that are considered by the Chinese state to pose a threat to its stability. The malicious spyware is designed to appeal directly to victims or imitate popular apps.

Individuals at risk of being targeted by these spyware apps are strongly encouraged to follow new advice to help protect their devices and data.

Foreign intelligence services have a vast number of tools at their disposal, which they use to illicitly gather information or target certain individuals. Interagency and international advisories aim to build resilience against global threats. Given the volatile threat landscape, advisories are an important tool to provide mitigation guidance against known vulnerabilities and strengthen defence mechanisms.

The Bundesamt für Verfassungsschutz (BfV) has installed a hotline, where individuals can confidentially report threats from foreign intelligence services or any espionage activities they have witnessed. Appeals in English and Chinese are available on the BfV website.