Fake Bahrain Alert App Spreads Android Surveillance Malware

Key points

• Dream Research reported on July 20 that BH Alert poses as a Bahraini civil-defense emergency alert app.
• The app deploys a four-stage surveillance platform that harvests credentials, SMS messages, contacts and screenshots.
• Distribution runs through cloned Google Play pages impersonating official Bahraini government entities.
• Once installed, the malware phones home on a roughly five-second heartbeat detectable without decrypting traffic.

Dream, a cybersecurity firm focused on national defense and critical infrastructure, published findings on July 20 about a malicious Android app named BH Alert. It isn't on the real Google Play Store. It's on cloned sites built to look like one.

The app disguises itself as a civil-defense tool, promising emergency alerts in English and Arabic while impersonating Bahrain Civil Defense and the Ministry of Interior. What it actually installs is a four-stage surveillance platform capable of harvesting lockscreen credentials, SMS and one-time codes, contacts and screenshots, running banking-app overlays, and taking full remote control of the device. Persistence survives a reboot.

The core payload is OctagonPanel, a remote-access trojan that intercepts SMS, steals credentials, captures screenshots, runs phishing overlays on banking apps and maintains operator control. It works alongside the Ward framework, which handles command-and-control and remote operations. A compromised employee handset could be enough to bypass multi-factor authentication and reach corporate systems.

Timing is the point. Bahrain, Kuwait and other Gulf states activated civil-defense protocols following Iranian missile strikes, driving sharp spikes in installs of official alert apps. The attackers inserted BH Alert into that demand. Fear, Dream's researchers wrote, does the distribution work for you.

How did the hackers get in?

Researchers couldn't pin down an exact initial vector, but assessed based on similar campaigns that smishing links and social media messages drove users to fake landing pages. Those pages clone the Google Play Store under names like Bahrain Civil Defense and the Information and eGovernment Authority, complete with government publisher labels, 100,000-plus download counts and fabricated reviews.

Once opened, the app walks users through a sequence of permissions that look appropriate for emergency alerts. They're not. Granting them installs the payload package and hands the malware the privileges it needs to persist.

Should you worry about your organisation?

For enterprises, the practical exposure isn't exotic. A Dream Research Lab spokesperson told Dark Reading that mobile device management (MDM) can enforce policy, block sideloaded apps and restrict which applications run on a VPN, but MDM alone isn't enough. Network monitoring catches what MDM misses: OctagonPanel's steady five-second check-in is an identifiable traffic anomaly that stands out even without decrypting the connection.

This is the second app of this kind Dream has detailed in 2025. In March the firm reported a trojanised version of the Israeli Red Alert app distributed via phishing. The pattern is consistent: take a category of software civilians already trust, dress it in official colours, and release it when attention is on the threat the app claims to address. The defence question isn't whether this technique works. It plainly does. It's whether your mobile fleet would catch it.