HOMETHREATSbadbazaar
APT / THREAT GROUP

badbazaar

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

BadBazaar is a type of malware primarily functioning as a spyware. Designed to compromise Android and iOS devices, it is often distributed through malicious apps downloaded from unofficial app stores, third-party websites, Telegram channels, and social engineering. Once installed, BadBazaar seeks to surveil the victim by intercepting SMS messages, performing screen recordings, and logging keystrokes on the device. Additionally, it can execute remote commands and download and install other malicious applications, further compromising the security of the affected device.

Threat Analysis

badbazaar is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

apk.badbazaarbadbazaar

External Intelligence

Malpedia: apk.badbazaar

Research Links

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
badbazaar — APT / Threat Group | Threat Intelligence | CTIWATCH.COM