Hackers (Representational)

The fight of rockets and missiles between the US-Israel and Iran seems to have turned into a cyber warfare as a cybersecurity research firm has claimed to have uncovered a sophisticated spying campaign targeting Israeli civilians. This technique is said to exploit one of the country’s most trusted emergency tools to secretly steal personal data from their phones.According to researchers at Acronis Threat Research Unit (TRU), this spyware attack is built around a fake version of the Red Alert app, which is a widely used rocket and missile warning application that millions of Israelis rely on for real-time safety notifications during conflict.

How Hackers are using fake ‘Red Alert’ app to spy on Israeli users

According to the research team, the campaign begins with a text message sent to victims’ phones. This SMS appears to come from Israel’s official Home Front Command – the government body responsible for civilian safety during military emergencies – claiming that there is a malfunction with the existing Red Alert app and urges the recipient to download an updated version immediately.The SMS contains a shortened link, which redirects the user to download a file that looks, on the surface, exactly like the legitimate Red Alert app but it is not.The researchers who identified the campaign on March 1, after it was reported by multiple Israeli citizens on social media, said that the app is a trojanised version of the real Red Alert application. This means that it has been modified and infected with malicious code while still functioning as a normal rocket alert tool.“The urgency to install or update such an application overrides the caution users might otherwise exercise, particularly when the delivery message appears to originate from the Home Front Command,” the Acronis report notes.

Researchers say the app is designed to look legitimate

What makes this attack particularly dangerous is how convincingly it mimics the real app. The fake app retains full rocket alert functionality — it still sends genuine notifications, just like the legitimate version. A user who installs it would have no reason to suspect anything is wrong. However, the malware is hard at work behind the scenes.The researchers said that the hackers are using certificate spoofing and other techniques to trick Android’s built-in security systems, which treat the app as legitimate software, essentially bypassing the checks designed to catch exactly this kind of threat.

What data does the spyware steal

Once installed, the malware begins harvesting sensitive personal data, including messages, contacts, location data, device account information, and a list of all installed applications. The stolen data is first stored locally on the phone, then continuously transmitted to a remote server controlled by the attackers.Cybersecurity experts advise Israeli users and anyone in a region where similar tactics could be deployed to follow these basic precautions.