08-08-2025
Morocco Top African Target in Chinese Malware Attack on 11,000 Devices Worldwide
Rabat – Cybersecurity researchers have identified Morocco as the main African target in a rapidly expanding global cybercrime operation using a sophisticated Android Remote Access Trojan (RAT) known as PlayPraetor.
The large-scale campaign, orchestrated by Chinese-speaking threat actors, has infected more than 11,000 devices worldwide in under three months.
While Europe remains the primary focus, with Portugal, Spain, and France recording the highest infection rates, a report by Cleafy Threat Intelligence said Morocco is the continent's most significant hotspot.
'Accounting for 22% of total infections, the botnet's footprint in Africa is characterised by a geographically dispersed activity, with the clear exception of Morocco, which has emerged as the continent's primary hotspot,' reads the report.
The malware is spread through fraudulent Google Play Store pages and enables full real-time control of infected smartphones. Once installed, it can steal banking credentials, intercept SMS messages, capture screenshots, and even stream the victim's screen live to cybercriminals.
The RAT is part of a Malware-as-a-Service (MaaS) model, which allows multiple criminal affiliates to run independent campaigns while using shared infrastructure.
Moroccan victims are believed to be targeted primarily in French and Arabic.
The growing Arabic-language infections, which saw a sharp spike in late June, may signal an intensifying wave of attacks against users in Morocco and across North Africa. The malware's operators have been continuously updating its capabilities, which makes it harder to detect and block.
'A final, telling development is the sudden, sharp spike in Arabic-speaking victims in the last week, which may signal the opening of another major campaign front,' added the report.
The report concluded that the campaign is growing by more than 2,000 new infections each week, and is increasingly targeting Spanish and French speakers. Tags: Androidmalware attackMorocco
