Massistant: Chinese Forensic Tool Harvests SMS, Images, Audio, and GPS Data from Mobile Devices

Researchers at Lookout Threat Lab have recently uncovered “Massistant,” an advanced Android-based mobile forensics application actively deployed by Chinese law enforcement to extract sensitive information from mobile devices.

The tool is considered the direct successor to “MFSocket,” an earlier forensics solution developed by the publicly listed firm Xiamen Meiya Pico Information Co., Ltd., now known as SDIC Intelligence Xiamen Information Co., Ltd.

First identified on Chinese social media in 2019 and corroborated through technical analysis, MFSocket had become notorious for allowing police to collect device-level evidence at border checkpoints and during police stops via physical access to the device.

The emergence of Massistant marks a significant evolution in mobile forensics capabilities within mainland China, building upon and expanding the feature set of its predecessor.

Data Collection Capabilities

Massistant is not distributed via conventional application stores but requires installation through physical device access, typically at the hands of authorities.

Upon launch, the application requests a comprehensive suite of permissions: access to GPS location, SMS messages, contacts, call logs, images, and audio files.

The forensic tool is designed to operate in conjunction with proprietary desktop software specifically, the Meiya Pico “Mobile Master” ecosystem establishing communication via localhost over port 10102, mirroring the architecture of MFSocket.

The application leverages Android Debug Bridge (ADB) and port forwarding to facilitate seamless data extraction while the device is connected via USB.

Unlike typical spyware, Massistant does not maintain persistent internet-based command and control infrastructure; its primary data exfiltration occurs during direct USB connections.

Massistant also employs sophisticated methods such as Android Accessibility Services, labeled internally as “AutoClick,” to automatically overcome device security prompts and expedite permission acquisition.

This tactic can bypass certain security controls, including those implemented by security-centric Android environments like Xiaomi’s MIUI Security Center.

Furthermore, Massistant enhances third-party messaging data collection, expanding beyond Telegram (as supported by MFSocket) to include Signal and Letstalk.

International Implications

Once exfiltration is complete and the USB connection is severed, Massistant is programmed to self-delete using a BroadcastReceiver, reducing its likelihood of post-analysis discovery.

Nonetheless, reports from Chinese Q&A forums indicate that unsuccessful uninstallation events have allowed users to detect the application on returned devices.

Notably, the app included only two non-system default language options: Simplified Chinese and US English, indicating a focus on both domestic and international targets.

The introduction of Massistant occurs alongside legislative shifts specifically, a 2024 law empowering Chinese police to analyze confiscated devices without a warrant which heightens the risk for business travelers and expatriates.

Lookout researchers have documented anecdotal evidence of business travelers’ devices being persistently compromised, sometimes with “headless” surveillance modules remaining after return.

Meiya Pico, recently rebranded as SDIC Intelligence, controls approximately 40% of the digital forensics market in China and maintains an international presence, with past sales reaching Russian military and participation in Belt and Road forensic training programs.

In 2021, the company was sanctioned by the US government for ties to Chinese military intelligence activities. Chinese authorities reportedly advise against manual uninstallation of forensic tools like Massistant, with references surfaced on local forums, although no direct documentation was found on government sites.

Indicators of Compromise (IoC)

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates