ToTok app tied to UAE spy front DarkMatter

Analysis of the wildly popular UAE messaging app ToTok shows it harvests contacts, media and location data, and researchers link its operator to Emirati intelligence firm DarkMatter.

Objective-See performed a technical triage of ToTok, a hugely popular VoIP/chat app in the UAE that U.S. officials reportedly assessed as a surveillance tool built for Emirati intelligence. After jailbreaking an iOS device with checkra1n, decrypting the app with Clutch, and intercepting its TLS traffic via a proxy and SSL Kill Switch 2, the researcher found no exploits, backdoors, or traditional malware — instead the app abuses standard, user-granted iOS permissions to exfiltrate the entire address book, uploaded media, device identifiers, and precise GPS coordinates to servers under the totok.ai domain and a weather API endpoint.

Class-dump analysis revealed the app is largely repackaged code from a Chinese company, YeeCall, and embedded developer paths suggest ties to that codebase rather than an original, from-scratch build by the listed publisher 'Breej Holding Ltd.' Independent research by Bill Marczak (Citizen Lab), cited alongside the New York Times reporting, mapped the corporate structure behind ToTok to DarkMatter, an Abu Dhabi cyberintelligence firm, and to a senior UAE intelligence official.

The analysis concludes that ToTok's power as a surveillance platform lies entirely in legitimate, Apple-approved functionality — contact/location/media permissions users willingly grant — enabling mass metadata collection across a large share of the UAE population as a potential 'phase 1' for more targeted follow-on operations. No CVEs, malware payloads, or active exploitation were identified; the risk stems from mass data collection under the guise of a legitimate consumer application.

Source reporting: https://objective-see.org/blog/blog_0x52.html