"Neither app containing the spyware was available in official app stores; both required manual installation from third-party websites posing as legitimate services," ESET researcher Lukáš Štefanko said. The ToSpy campaign, which likely began on June 30, 2022, and is currently ongoing, has leveraged fake sites impersonating the ToTok app to deliver the malware. "Any future launches of the malicious ToTok Pro app will instead open the real ToTok app, effectively masking the spyware's presence. However, the user will still see two apps installed on the device (ToTok and ToTok Pro), which could be suspicious." "After the user launches the malicious ToTok app, there are two possible scenarios: either the official ToTok app is installed on the device or it's not."