exploitio

During the IR/IL war, I highlighted why a compromise of the Bad-e-Saba mobile app could matter for wartime tracking and effects delivery. A recently rushed update of Divar mobile app seem to be showing a similar but much worse pattern. ⚠️This is my speculation, not fact, that this case is a state-sponsored compromise!⚠️ Their app (and safe to assume their entire infrastructure) was compromised and backdoored. The backdoor basically allows specially crafted and encoded push notification, to specific/all users, to deliver a payload to the app, which is then exected on the mobile device. Neat delivery and C2 mechansim! The app versions released between Nov 2025 and Sep 2026 were compromised. Considering their massive used base (claimed 30+ Million), this could have been a hell of a targeting and pre-positioning oportunity before the war. It might sound puzzling why a second-hand marketplace website and mobile app might be an interesting target? What can you even do with code-execution on a grandma's phone selling her old squeaky sofa? Any database or platform that can directly link an identifier to an individual or location is the intelligence equivalent of digital gold. Want to track an individual, or a cluster of people, based on any PII (personally identifiable information)? Divar and similar platforms are just perfect for that. Now consider that many of those users also have the app installed on their phones. You’ve identified and clustered some of them, and you want more data from their devices—or, potentially, live tracking, a hot mic, or anything in between. That's why you insert such covert capability into their app. You no longer would need expensive 0-click Android or iOS chains and risk burning them. You can target any specific user and run arbitrary code on the device. The code can be a local privilege escalation exploit (which is MUCH cheaper & easier to maintain) and you're pretty much done! The genius behind this whole chain, and the timing of infections, makes me consider it extremely unlikely for this to be just a simple nasty developer's approach to a problem that I can't even imagine what it could have been. Notification messages are logged on both devices and backend, in multiple places. I guess we have to hope Divar will release a proper analysis report of this case. In reality however, chances of hearing anything back is as high as any other notable incident during the same timeframe. nearly zero.