CSAIS
IDEN
CriticalEarly warningMalwareTurkey · English

Suspected spyware attacks target Turkish ministers’ phones

First seen 3 Sept, 14:00 WIBLatest 16 Oct47 articles · 44 publishers · 3 syndicated
victim: phonesVerify evidence
77
Confidence index · preliminarycomputed by the pipeline (V0.7)high
Corroborated by distinct domains
Independent sources
Victim identified
Full text available
Clustering consistency
Status and preventive steps
Early warningMachine output from news coverage; not verified by the public or institutions
Preventive steps
  • Turn on two-step verification for email, banking, and social media.
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
Literacy audienceAndroid users in IndonesiaiPhone users in IndonesiaSocial media and messaging users
Literacy topics
  1. System updates and security patches
  2. The danger of APK files and unofficial apps
  3. How to report and keep evidence

Report toPatroli Siber Polri

Extracted claims

Victimconfidence 0.60
Phones
Actornot found
not identified
Attack typeconfidence 0.90
Malware6 differing values across articles; review needed.
Event datenot found
not identified
LocationTurkey
Target groupIndividuals
Status
  • D1 Machinehigh trust
Conclusion
  • D1 MachineHappened

Source chronology

47 articles, by publication time

3 September 20261 articles

  1. 14:00 WIBFirst report
    ICE Authorised Commercial Spyware Later Linked to a Tool That Can Hack Phones and Read Encrypted Chats Without a Clickibtimes.co.uk

8 September 20262 articles

  1. 14:00 WIB+120 h
    Suspected spyware attacks target Turkish ministers’ phonesmiddleeasteye.net
  2. 14:00 WIB+120 h
    Türkiye replaces ministers' phones after Apple spyware alertTürkiye Today

9 September 20261 articles

  1. 22:29 WIB+152 h
    Turkey replaces ministers’ phones after Apple spyware alert: reportTurkish Minute
Show all 47 articlesCollapse

11 September 20261 articles

  1. 14:00 WIB+192 hfull text hashed
    iPhone Under Attack: Three Turkish Ministers Targeted by Spywarezamin.uzPhones

25 September 20261 articles

  1. 10:44 WIB+525 h
    Pakistan approves encrypted phones for senior officials amid data theft concernsarabnews.pk

30 September 20262 articles

  1. 16:14 WIB+650 h
    RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App PermissionsCyberSecurityNews
  2. 17:44 WIB+652 h
    RATHat Android malware reportedly uses Gemini AI to control phones beyond normal app permissionsBusiness Upturn

4 October 20262 articles

  1. 07:56 WIB+738 h
    Dangerous Android malware discovered that could turn phones into spying tools.Vietnam.vn
  2. 09:03 WIB+739 h
    Identity theft 'mule' helped hijack Spark customers' phones, bank appsNZ Herald

5 October 20261 articles

  1. 14:17 WIB+768 h
    Government Bans Personal Phones in Nurseries Following Vincent Chan Abuse Conviction and Cyber Attackshttps://streamlinefeed.co.ke/

8 October 20264 articles

  1. 20:00 WIB+846 h
    Some cheap Android phones are shipping with malware baked inAndroid Authority
  2. 20:03 WIB+846 h
    Thousands of cheap Android phones shipped with ad-fraud malwareThe Record from Recorded Future News
  3. 22:28 WIB+848 h
    Midnight Mimosa Malware Found Preinstalled on Low-Cost Android PhonesHackread
  4. 22:50 WIB+849 h
    Midnight Mimosa: Malware Found Baked Into Cheap Android PhonesAndroidPure

9 October 20263 articles

  1. 02:20 WIB+852 h
    Low-cost Android phones ship with residential proxy malwareBleepingComputer
  2. 04:09 WIB+854 h
    Malware found preinstalled on thousands of cheap Android phonesmediasat.info
  3. 22:36 WIB+873 h
    Malware Found Preinstalled on Cheap, Counterfeit Android PhonesPCMag Australia

10 October 20262 articles

  1. 00:41 WIB+875 h
    Budget Android Phones Found Shipping With Preinstalled Malware Across 150 CountriesThe420.in
  2. 02:49 WIB+877 h
    Malware preinstalled on cheap Android phones generates ad fraudSC Media

11 October 20262 articles

  1. 10:08 WIB+908 hSyndicated
    Malware Found Preinstalled on Cheap, Counterfeit Android PhonesPCMag Middle East
  2. 15:33 WIB+914 h
    Bitdefender reveals Midnight Mimosa, the malware preinstalled on cheap Android phonesPasquale Pillitteri

12 October 20264 articles

  1. 16:39 WIB+939 h
    Vietnam Social Security warns of tricks to impersonate officials, install malware on people's phonesLaodong.vn
  2. 17:53 WIB+940 h
    Low-cost Android phones are arriving with malware that owners can’t uninstallHelp Net Security
  3. 20:04 WIB+942 h
    Thousands of Android phones shipped with undeletable malware, powering ad-fraud in over 150 countriesCybernews
  4. 22:24 WIB+944 h
    Low-Cost Android Phones Ship With System-Level Malware That Cannot Be UninstalledCyber Press

13 October 20268 articles

  1. 00:25 WIB+946 h
    Experts warn cheap Android phones are being shipped with malware built in, so be on your guardTechRadar
  2. 05:34 WIB+952 h
    Real fake phones can be found with real malwarePickr
  3. 12:36 WIB+959 h
    Malware preinstalled on low-cost Android phones hits users in 150 countries디지털투데이
  4. 13:00 WIB+959 h
    Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential ProxiesThe Hacker News
  5. 16:30 WIB+963 h
    Midnight Mimosa Malware Found Preinstalled on Android Phones in More Than 150 Countrieswww.tokenpost.com
  6. 16:45 WIB+963 h
    Thousands of budget Android phones shipped with preinstalled Midnight Mimosa malware worldwidePluang
  7. 19:16 WIB+965 h
    Cheap Android phones ship with Midnight Mimosa: firmware malware that can survive a factory resetSoftonic
  8. 22:00 WIB+968 h
    Cheap Android phones found with malware already installedKurt the CyberGuy

14 October 20261 articles

  1. 06:41 WIB+977 h
    Urgent: Malware detected pre-installed on cheap Android phones.Vietnam.vn

15 October 20267 articles

  1. 05:00 WIB+999 h
    Experts warn cheap Android phones are shipping with malwaregeekspin
  2. 17:00 WIB+1011 h
    New ‘zero-click’ spyware hacked phones using targeted adsft.com
  3. 19:45 WIB+1014 h
    Millions of phones exposed to Israeli spyware operation through online ads, researchers sayPOLITICO.eu
  4. 21:13 WIB+1015 hfull text hashed
    New 'zero-click' spyware hacked phones using targeted ads, UofT researchers discoverfinancialpost.com
  5. 23:01 WIB+1017 hfull text hashed
    Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Adsthehackernews.comPhones
  6. 23:14 WIB+1017 hfull text hashed
    Zero-Click Spyware Is Infecting Phones Through Targeted Adstech.yahoo.com
  7. 23:14 WIB+1017 hSyndicatedfull text hashed
    Zero-Click Spyware Is Infecting Phones Through Targeted Adsgadgetreview.com

16 October 20265 articles

  1. 03:44 WIB+1022 h
    Israeli spyware reaching millions of phones worldwide, researchers sayupi
  2. 06:17 WIB+1024 h
    Malware Found Pre-Installed In Thousands Of Budget Android Phones - Here's What We KnowBGR
  3. 14:18 WIB+1032 h
    Researchers Uncover Android Malware That Secretly Controls Phones and Captures Banking PINsCyber Press
  4. 14:18 WIB+1032 hSyndicated
    Researchers Uncover Android Malware That Secretly Controls Phones and Captures Banking PINsCyber Press
  5. 23:09 WIB+1041 hfull text hashed
    ‘Nightmare Scenario’: Zero-Click Spyware Infecting Phones via Targeted Adswhowhatwhy.org
Relations between articles
14 pairs likely independent1 pairs uncertain

Evidence

Hashes prepared6full text hashed 6
first evidence_uid52e81a5dcf7f057f6cf120a1
6 of 6 evidence records are in Merkle batches

Flow comparison D1–D4

each flow's preventive output; this is where they differ · D1 changed 14 times · since 29 Sept
D1Machine17 OctD2Public surveynone yetHelp reviewD3Institutionnone yetD4Official recordnone yet
Summary (AI)

Ponsel pejabat tinggi dilaporkan menjadi sasaran spyware canggih yang mampu membaca pesan terenkripsi tanpa perlu interaksi pengguna. Insiden ini relevan di Indonesia karena ancaman celah keamanan ponsel dan spyware serupa dapat menyasar siapa saja melalui perangkat pintar sehari-hari.

–––
Literacy audience (AI)
  • Aparatur sipil negara dan staf lembaga pemerintah pengguna iPhoneIndonesia
  • Jurnalis dan penggiat HAM pengguna WhatsApp di ponsel pintarIndonesia
–––
Topics (AI)
  1. Mengenal bahaya spyware zero-click yang dapat menginfeksi ponsel tanpa perlu mengeklik tautan
  2. Arti dan tindak lanjut saat menerima notifikasi peringatan ancaman keamanan resmi dari produsen ponsel
  3. Pentingnya pembaruan berkala sistem operasi dan aplikasi pesan instan untuk menjaga enkripsi komunikasi
–––
Steps (AI)
  • Segera perbarui sistem operasi ponsel ke versi terbaru untuk menutup celah keamanan zero-day
  • Aktifkan fitur perlindungan tingkat lanjut seperti Lockdown Mode pada perangkat iPhone yang berisiko tinggi
  • Jangan abaikan peringatan ancaman resmi langsung dari sistem keamanan produsen perangkat
  • Lakukan restart ponsel secara berkala untuk memutus proses malware yang berjalan di latar belakang
–––
Key message (AI)

“Rutin perbarui sistem ponsel Anda dan waspadai peringatan keamanan perangkat.”

–––
Institution's reason––––
Catalog-based advice (no AI)
Literacy audienceAndroid users in IndonesiaiPhone users in IndonesiaSocial media and messaging users–––
Literacy topics
  1. 1.System updates and security patches
  2. 2.The danger of APK files and unofficial apps
  3. 3.How to report and keep evidence
–––
Preventive steps
  • Turn on two-step verification for email, banking, and social media.
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
Report to Patroli Siber Polri
–––

✦ AI advice Written by an AI model (gemini-3.8-flash) from each flow's inputs; it can be wrong, so review it before using it as official advice.Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents