We are seeing reports of a new Android spyware called ResidentBat malware affecting mobile devices as of December 2025, targeting Android OS 10 and 11.
Discovery and Technical Details
According to Tushar Subhra Dutta, the malware was discovered by Reporters Without Borders (RSF) and RESIDENT.NGO. The first public report appeared in December 2025 through a joint investigation. The code history suggests it was quietly developed and deployed. ResidentBat exfiltrates data via background services that use hidden permissions to access personal information, communications, and device logs.
Who Should Be Concerned?
Most importantly, this threat is relevant for journalists, civil society members, government agencies, and mid-market to enterprise organizations that rely on mobile devices. CISOs and system administrators must review Android configurations, enforce strict permission policies, and monitor for unusual background activity. Regulatory implications include GDPR for EU users, HIPAA for US healthcare providers, and potential breaches of national security protocols.
Historical Context
Notably, similar spyware incidents such as GhostBat in 2023 targeted journalists and was linked to state actors. The pattern shows a gradual evolution of state-sponsored malware designed to persistently access mobile devices.
Impact Assessment
Currently, an estimated 10 million Android devices worldwide could be vulnerable, exposing personal data and communication logs. Attack progression includes initial infiltration via malicious app downloads, persistent background access, and continuous exfiltration of sensitive data. Threat actors are believed to be Belarusian KGB operatives.
Immediate Actions Required
Immediately, organizations should patch Android OS 12.0 (released in 2026) to mitigate the vulnerability. The deadline for applying the patch is within 24 hours from this advisory. Verification steps include running anti-malware scans on all devices, reviewing device logs for suspicious activity, and ensuring background services are disabled or restricted. Alternative mitigations involve disabling unnecessary permissions and using secure mobile management tools. Detection guidance includes monitoring mobile security dashboards for anomalous behavior.
Additional Resources
Additional resources: Tushar Subhra Dutta – https://cybersecuritynews.com/residentbat-android-malware/
For further alerts, consult CISA/CERT advisories.
Get Expert Help
Get expert help at https://defendmybusiness.com/
Sources
Tushar Subhra Dutta: https://cybersecuritynews.com/residentbat-android-malware/
Related security updates: VLC for Android < 3.7.0 Path Traversal Exploit – Patch Now | Steaelite RAT Fuels New Wave of Double Extortion Threats Targeting Enterprises (HIGH PRIORITY) | Ivanti Zero Day Exploit Allows Full Remote Takeover
