Sacred Malware: Israel Espionage Hidden Behind an Arabic Religious App

In an era where security boundaries have shifted into the digital realm, espionage tactics have evolved alongside technology. Physical infiltration, traditional wiretapping, or field agents are no longer necessary. Today, a single Android app can silently breach hundreds of smartphones without the victims ever realizing it.

A new investigation by the “EekadFacts” platform has revealed one of the latest examples of such digital attacks: an Arabic-language app with a religious appearance that was, in fact, a spyware tool crafted by the Zionist regime.

According to the report, the malicious app—disguised with an Arabic religious name and interface—was designed and distributed using infrastructure registered in the occupied territories. The app connected to a domain named “Palpray.co,” a blend of “Palestine” and “Prayer,” chosen specifically to gain the trust of Arabic-speaking users, particularly Palestinian Muslims. This domain served as the command-and-control (C2) hub for the malware, allowing attackers to remotely extract sensitive data and execute commands once the app was installed on the victim’s device.

Technical analysis shows the domain was registered by the Israeli company “Wix” and used Cloudflare services to mask the true identity of its servers. Although the domain is currently inactive, evidence confirms it was operational for a period and used to manage malware communications. This constitutes a sophisticated and targeted cyberattack, designed with intimate knowledge of the target community and enhanced by cultural and religious elements to increase deception.

The choice of language and religious branding was central to the operation. The app featured a fully Arabic interface, religious-themed content, and a name evoking prayer and worship—all crafted to instill trust and a sense of safety in users. This technique, known in cybersecurity as social engineering, is one of the most effective methods for targeting human vulnerabilities. Victims often install such apps without verifying their origin—especially when presented with familiar names or religious themes.

In terms of targets, the operation likely aimed at Palestinian users, civil society activists, journalists, and possibly members of resistance groups. Previous research by organizations like Citizen Lab and Amnesty Tech has documented similar tactics used by the regime to infiltrate digital devices of opponents in Lebanon, Syria, Gaza, and the West Bank.

While this revelation is just one among many similar attacks, it once again highlights the critical importance of public awareness around cyber threats. In a time when trust in an app’s appearance can lead to exposure of private lives and confidential data, users in politically sensitive regions must be trained to detect hidden dangers. Moreover, digital rights watchdogs and regulatory bodies must enforce stricter oversight over the development and distribution of suspicious apps on open platforms like Android.

Source:
https://x.com/EekadFacts/status/1917531877864530366
https://www.amnesty.org
https://www.accessnow.org
https://research.checkpoint.com