VORANT. Threat Intelligence Sign in Get the full feed

ToTok app tied to UAE spy front DarkMatter

routine threat government-national

Analysis of the wildly popular UAE messaging app ToTok shows it harvests contacts, media and location data, and researchers link its operator to Emirati intelligence firm DarkMatter.

Objective-See performed a technical triage of ToTok, a hugely popular VoIP/chat app in the UAE that U.S. officials reportedly assessed as a surveillance tool built for Emirati intelligence. After jailbreaking an iOS device with checkra1n, decrypting the app with Clutch, and intercepting its TLS traffic via a proxy and SSL Kill Switch 2, the researcher found no exploits, backdoors, or traditional malware — instead the app abuses standard, user-granted iOS permissions to exfiltrate the entire address book, uploaded media, device identifiers, and precise GPS coordinates to servers under the totok.ai domain and a weather API endpoint.

Class-dump analysis revealed the app is largely repackaged code from a Chinese company, YeeCall, and embedded developer paths suggest ties to that codebase rather than an original, from-scratch build by the listed publisher 'Breej Holding Ltd.' Independent research by Bill Marczak (Citizen Lab), cited alongside the New York Times reporting, mapped the corporate structure behind ToTok to DarkMatter, an Abu Dhabi cyberintelligence firm, and to a senior UAE intelligence official.

The analysis concludes that ToTok's power as a surveillance platform lies entirely in legitimate, Apple-approved functionality — contact/location/media permissions users willingly grant — enabling mass metadata collection across a large share of the UAE population as a potential 'phase 1' for more targeted follow-on operations. No CVEs, malware payloads, or active exploitation were identified; the risk stems from mass data collection under the guise of a legitimate consumer application.

Mentioned in this report

Threat actors DarkMatter
Malware ToTok

Detection guidance

Mobile App Accessing Address Book and Location Data

ATT&CK T1636.003

Detects mobile applications requesting and accessing contact list (address book) and precise GPS location data simultaneously, characteristic of mass surveillance data collection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mobile App Accessing Address Book and Location Data
description: Detects mobile applications requesting CNContact and CoreLocation permissions
  together and subsequently accessing address book and GPS location data. This behaviour
  is typical of surveillance applications that exfiltrate contact metadata and precise
  coordinates.
tags:
- attack.collection
- attack.t1636.003
- attack.t1430
logsource:
  category: process_creation
  product: ios
detection:
  selection_contacts:
    Image|endswith: Contacts
    CommandLine|contains:
    - CNContactStore
    - ABAddressBook
  selection_location:
    Image|endswith: LocationServices
    CommandLine|contains:
    - CLLocationManager
    - kCLLocationAccuracyBest
  condition: selection_contacts and selection_location
falsepositives:
- Legitimate navigation/mapping applications that require both contacts and location
- Social networking apps with location-based contact features
level: medium
id: 42e8d298-d004-5dc0-80c3-22511e7a7b02
status: experimental
author: Vorant

Mobile App Exfiltrating Address Book and Media to Remote Server

ATT&CK T1533

Detects mobile applications accessing local address book and uploaded media files, then transmitting this data to remote servers outside the device. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mobile App Exfiltrating Address Book and Media to Remote Server
description: Detects applications reading address book (CNContact, ABAddressBook)
  and media assets (Photos, Documents), then initiating network connections to transmit
  this local system data to remote hosts. Characteristic of mass metadata collection
  platforms.
tags:
- attack.collection
- attack.t1533
logsource:
  category: network_connection
  product: ios
detection:
  selection_source:
    SourceImage|contains:
    - CNContact
    - ABAddressBook
    - PhotoLibrary
    - DocumentDirectory
  selection_destination:
    DestinationHostname|endswith:
    - .totok.ai
    - .ai
    DestinationPort: 443
  condition: selection_source and selection_destination
falsepositives:
- Cloud sync applications (iCloud) backing up photos and contacts
- Photo sharing applications uploading media with contact metadata
level: high
id: 09cb6ae3-dd8e-5624-8a57-6dbdf146c66e
status: experimental
author: Vorant

Mobile App Collecting Device Identifiers and Location for Transmission

ATT&CK T1071

Detects mobile applications gathering device identifiers (IDFA, IDFV, UUID) and GPS coordinates, then transmitting via encrypted TLS to remote command-and-control infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mobile App Collecting Device Identifiers and Location for Transmission
description: Detects applications accessing device identifiers and location data,
  then initiating HTTPS connections to transmit this metadata. Surveillance applications
  use this pattern to maintain device fingerprints and track targets across sessions.
tags:
- attack.collection
- attack.t1430
- attack.t1071.001
logsource:
  category: network_connection
  product: ios
detection:
  selection:
    SourceProcess|contains:
    - ASIdentifierManager
    - UIDevice
    - CLLocationManager
    CommandLine|contains:
    - advertisingIdentifier
    - identifierForVendor
    - coordinate
    DestinationPort: 443
    Protocol: TLS
  condition: selection
falsepositives:
- Legitimate analytics SDKs collecting device identifiers for crash reporting
- Location-based mobile services transmitting coordinates to weather APIs
level: medium
id: d1565ebc-6104-5852-9933-b54e305172d4
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x52.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free