In 2018, Lookout Security Intelligence reported that Android spyware called Stealth Mango was used in a targeted surveillance campaign, with fake Facebook profiles and Messenger messages helping lure people into installing malicious apps. Lookout assessed that members of Pakistan’s military operated the campaign; that is the security firm’s attribution, not a judicial finding. The report also identified an iOS component, Tangelo, but was less certain that it had been used operationally.
What was Stealth Mango spyware?
Stealth Mango was Android surveillanceware that Lookout described as deployed against selected people to collect data from their phones. Lookout’s May 2018 technical report also discussed Tangelo, an associated iOS component. It did not establish that Tangelo was used in the same way: the component may instead have been in development or testing. Lookout’s technical report is the primary source for the malware’s capabilities and the company’s assessment of the operation.
The campaign relied on getting a victim to install an app, rather than on a reported zero-day exploit. Lookout’s Andrew Blaich summarized the approach in a May 2018 interview with CyberScoop: “No exploits, just an overly-permissive app they phish users into installing on to their phones in very targeted scenarios.” CyberScoop’s contemporaneous report includes the interview.
How did the campaign use Facebook Messenger?
Lookout said operators used fake Facebook personas to establish contact and send phishing messages, including through Messenger. Those messages steered selected targets toward installing an app, sometimes via a download page. Messenger was a channel for social engineering; it was not the spyware itself.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Lookout also raised the possibility that operators sometimes had physical access to devices. Its reporting does not establish physical access as a routine or universal infection method.
What information did Stealth Mango collect?
Lookout reported that data taken from compromised devices included sensitive personal, professional, and government material, such as:
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
- Letters and internal government communications.
- Travel details, identity documents, and passport images.
- GPS coordinates associated with devices or photographs.
- Legal and medical documents.
- Developer material, including whiteboard-session images and account information.
- Photographs from closed-door military or government events.
Lookout said it had analyzed more than 15 GB of data taken from compromised devices. CyberScoop separately reported more than 30 GB of stolen data. The two outlets did not explain the difference, so the figures should not be treated as interchangeable or combined.
Who was targeted, and how many people were infected?
Lookout observed targeting of officials, diplomats, military personnel, activists, and other people in Pakistan, Afghanistan, India, Iraq, Iran, and the UAE. It also reported that information belonging to people in the United States, Australia, and the United Kingdom was swept up after they interacted with direct victims. That indirect collection should not be confused with evidence that those people were themselves directly targeted.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The sources cited here do not establish a reliable count of unique infected people. The data-volume figures reported by Lookout and CyberScoop do not provide a way to calculate that number.
Was Tangelo used on iPhones?
Tangelo was the iOS component associated with Stealth Mango, but Lookout expressed uncertainty about whether it had been used against campaign targets or was still being developed and tested. The available reporting therefore supports identifying Tangelo as an iOS component, not claiming that iPhone users were confirmed victims of it.
Rank #4
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES, with cloud-based protection against viruses & other online threats
- Webroot PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, you know you’re in good hands. Stay safe from viruses, ransomware, phishing, and more.
- Webroot SOFTWARE UPDATES ITSELF AUTOMATICALLY, so you always have the most current protection without lifting a finger—and updates happen in the background so they won’t slow you down.
- PREMIUM FEATURES: Encrypts & protects passwords and account information for all your devices so you can stay protected wherever you are.
Who did Lookout say was behind the campaign?
Lookout assessed that members of Pakistan’s military operated the campaign, drawing on its investigation of the tools, infrastructure, and operator activity. This is Lookout’s attribution, not an independently confirmed government conclusion or a judicial finding. CyberScoop reported that the Pakistani Armed Forces did not respond to its request for comment.
Lookout said the tools’ developers were linked to a freelance developer group involved in other commodity Android and iOS spyware. Its report described activity and development as ongoing as recently as April 2018; that is a historical observation, not evidence that Stealth Mango remains active today.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBest Value
- Android Security & protection
- Daily Virus Database checkup and updates
- Scan Apps and Files
- System Cleaner Integrated
- Virtual Private Network (VPN)
What did Google do at the time?
Lookout quoted a Google spokesperson saying that Google had identified the associated apps, that none were on Google Play, and that Play Protect had been updated to protect devices and was removing the apps from affected devices. This describes Google’s response as reported in 2018, not the current status of any device or threat.
Is this the same operation Meta reported in 2023?
No connection is established by the cited reporting. Meta’s May 2023 threat report described a separate Pakistan-based, state-linked cyber-espionage operation that also used fake personas and relatively low-sophistication malware. Similar tactics do not demonstrate that it was the same group or a continuation of Stealth Mango. Meta’s first-quarter 2023 adversarial threat report provides that later account.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
