A recently found malware espionage campaign, called Dark Caracal, has affected thousands of people in 20 countries. The malware was discovered in January by two American cybersecurity organizations — Electronic Frontier Foundation (EFF) and Lookout. They tracked the source of the malware to a building belonging to the Lebanese national security agency, the General Directorate of General Security (GDGS).

At least since 2012, Dark Caracal has been actively transmitting private information, from call records and audio recordings to documents and photos, of military personnel, activists, journalists and lawyers living in the United States, Canada, Germany, France and Lebanon. This was made possible through trojanized apps, fake versions of applications, including Signal and WhatsApp. Trackers are able to take photos, retrieve location and information and capture audio. So far, no legal action or sanctions have been taken, and it remains unknown if the GDGS activities are still ongoing.

The joint investigation between EFF and Lookout started after EFF released a report called Operation Manul in August 2016. The report detailed a series of cyberattacks that targeted journalists and political activists critical of Kazakhstan’s authoritarian government, along with their family members, lawyers and associates living in the country and Europe.

“EFF’s research noted references to Android components that attackers used in tandem with the desktop malware,” Andrew Blaich, security researcher at Lookout, told Al-Monitor. “However, no samples had been discovered at the time of the report’s release. So Lookout went looking for the Android samples. Once we identified the samples, found the exfiltrated data, began to develop hypotheses around attribution and realized this story was much bigger than originally thought, Lookout reconnected with EFF to have them co-author the report with us.”