A malware can spy on nearly every Android smartphone function and steal passwords, photos, video, screenshots and data from WhatsApp, Telegram and other apps, Kaspersky Lab says.

'ZooPark' is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015. The threat actors behind the operation infect Android devices using several generations of malware, with the attackers including new features in each iteration. Security researchers at Kaspersky Lab label them from v1-v4, with v4 being the most recent version deployed in 2017.

From the technical point of view, the evolution of ZooPark has shown notable progress: from the very basic first and second versions, the commercial spyware fork in its third version and then to the complex spyware that is version 4. This last step is especially interesting, showing a big leap from straightforward code functionality to highly sophisticated malware.

The web security firm has observed two main distribution vectors for ZooPark - Telegram channels and watering holes. The second one was the preferred vector: several news websites that have been hacked by the attackers to redirect visitors to a downloading site that serves malicious APKs. Some of the themes observed in campaign include "Kurdistan referendum", "TelegramGroups" and "Alnaharegypt news", among others.

Target profile has evolved during the last years of campaign, focusing on victims in Egypt, Jordan, Morocco, Lebanon and Iran.

At the same time, Kaspersky suggested that the malware might not have been built in-house, and that the latest version may have been bought from vendors of surveillance tools. That wouldn't be surprising, as the market for these espionage tools is growing, becoming popular among governments, with several known cases in the Middle East.