ToTok app tied to UAE spy front DarkMatter
Analysis of the wildly popular UAE messaging app ToTok shows it harvests contacts, media and location data, and researchers link its operator to Emirati intelligence firm DarkMatter.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Objective-See performed a technical triage of ToTok, a hugely popular VoIP/chat app in the UAE that U.S. officials reportedly assessed as a surveillance tool built for Emirati intelligence. After jailbreaking an iOS device with checkra1n, decrypting the app with Clutch, and intercepting its TLS traffic via a proxy and SSL Kill Switch 2, the researcher found no exploits, backdoors, or traditional malware — instead the app abuses standard, user-granted iOS permissions to exfiltrate the entire address book, uploaded media, device identifiers, and precise GPS coordinates to servers under the totok.ai domain and a weather API endpoint.
Class-dump analysis revealed the app is largely repackaged code from a Chinese company, YeeCall, and embedded developer paths suggest ties to that codebase rather than an original, from-scratch build by the listed publisher 'Breej Holding Ltd.' Independent research by Bill Marczak (Citizen Lab), cited alongside the New York Times reporting, mapped the corporate structure behind ToTok to DarkMatter, an Abu Dhabi cyberintelligence firm, and to a senior UAE intelligence official.
The analysis concludes that ToTok's power as a surveillance platform lies entirely in legitimate, Apple-approved functionality — contact/location/media permissions users willingly grant — enabling mass metadata collection across a large share of the UAE population as a potential 'phase 1' for more targeted follow-on operations. No CVEs, malware payloads, or active exploitation were identified; the risk stems from mass data collection under the guise of a legitimate consumer application.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x52.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs