Early samples indicate the surveillance tool has been operational since at least 2017, with development continued into late 2024. It consists of two parts: an installer APK, and a surveillance client that runs headlessly on the device when installed.

A sophisticated phishing kit with novel tactics targets cryptocurrency platforms and the FCC through a combination of email, SMS, and voice phishing, successfully stealing high-quality data from mobile device users in the United States.

In total, Lookout researchers uncovered 251 Android apps on the Google Play store with over 15 million collective downloads. They also identified 35 apps on the Apple App Store that were in the top 100 finance apps in their regional stores.

Based on Lookout's analysis, the spyware is likely developed by Italian spyware vendor RCS Lab S.p.A and Tykelab Srl, a telecommunications solutions company suspected to be operating as a front company.