"Candy" is an Expo-based contact theft malware disguised as a video chat application. Distributed via [비공개], it leverages Google Play's Expo Go app as a trojan horse to load a malicious Expo project from [비공개]. Upon launch, it harvests the victim's entire contact list and device information, exfiltrating data to [비공개] The C2 server shares infrastructure with the previously analyzed telegram_gallery_2` (virbox_sens family). Chinese-language comments in source code indicate Chinese-speaking developers targeting Korean victims.
Field · Value
Display Name · Candy
Distribution URL · `[비공개]
Expo Project · `@anonymous` (no registered Expo account)
Expo Server · `[비공개]` (Vultr [비공개])
Framework · Expo SDK (React Native) + Expo Router
C2 Server · `[비공개]` (CF: [비공개] / [비공개], real: [비공개])
Category · Contact Theft
Threat Level · Critical
```
[Victim] → [비공개] (미끼 랜딩페이지)
↓ "App Store" / "Google Play" 클릭
[exp://[비공개]] (Expo deep link)
↓ Expo Go 미설치 시
[Google Play: host.exp.exponent] (Expo Go 설치)
↓ Expo Go로 악성 프로젝트 로드
[Candy UI] → 전화번호 입력 → "로그인"
↓ Contacts.requestPermissionsAsync()
[연락처 권한 승인] → getContacts() → 전체 연락처 수집
↓ 10초 LoadingAnimation (위장)
[POST [비공개] ]
↓ 기기정보 + 전화번호 + 연락처 전송
[Alert: "기기가 이 버전과 호환 되지 않습니다."]
```
· Domain: [비공개]
· IP: [비공개] / [비공개] (Cloudflare)
· Title: "Candy"
· Disguise: "BC Innovation" (1599-1401, contact@[비공개])
· OG Image: `[비공개] (dead domain)
URL · Purpose
`exp://[비공개]` · Expo deep link (both App Store/Google Play buttons)
`[비공개] · Expo Go install fallback
`[비공개] · iOS Expo Go install
`[비공개] · Background video
`[비공개] · OG image (dead)
· Professional landing page with fake Google Store / App Store reviews
· Video background for credibility
· Fake business entity "BC Innovation" with phone number 1599-1401
· CSS from /css/camtalk.css — template reuse from other scam apps
· File: app/(tabs)/index.tsx (ContactsSyncScreen)
· Server Path: /www/wwwroot/p/expo/ (Baota Panel hosting pattern)
```javascript
deviceName: Device.deviceName,
model: Device.modelName,
brand: Device.brand,
appId: Application.applicationId,
deviceId: await getDeviceId(), // Android: getAndroidId(), iOS: getIosIdForVendorAsync()
platform: Device.osName,
osVersion: Device.osVersion,
```
· Uses expo-contacts API
· Requests fields: Name, PhoneNumbers, Emails
· Filters contacts with valid name + phone number
· Extracts: name, phone numbers (with type labels), emails (with type labels)
```javascript
const phoneRegex = /^(010|011|016|017|018|019)([0-9]{3,4})([0-9]{4})$/;
```
Validates Korean mobile prefixes only.
· Endpoint: `POST [비공개]
· Content-Type: application/json
· Payload:
```json
{
"Platform": "Android",
"brand": "Samsung",
"deviceId": "...",
"model": "SM-G991B",
"version": "14",
"phoneNumber": "010-**-**",
"contacts": [{"id":"1","name":"...","phoneNumbers":[...],"emails":[...]}],
"timestamp": "2026-05-30T12:00:00.000Z"
}
```
1. 10-second animated loading screen (LoadingAnimation component)
2. Progress bar filling to 100%
3. Data sent during animation
4. Error message: "기기가 이 버전과 호환 되지 않습니다."
5. Victim believes app is incompatible; contacts already stolen
Field · Value
Domain · [비공개]
Cloudflare IPs · [비공개] / [비공개]
**Real IP** · **[비공개]** (leaked via [비공개] endpoint)
Root Response · "Hello World!"
API Response · `{"code":1,"msg":"success"}`
Status · **ALIVE - Actively receiving stolen data**
The [비공개] endpoint returns the server's real IP address [비공개]` in plaintext. This is a significant OPSEC failure by the operators, revealing the origin server behind Cloudflare.
· Same C2 as telegram_gallery_2 (virbox_sens family)
· Same "Hello World!" root response pattern
· Same .shop TLD API subdomain pattern
Domain · IP · Provider · Role
[비공개] · [비공개] (CF) · Cloudflare · Landing page
[비공개] · [비공개] (real) · Korea (KT range) · C2 server
[비공개] · [비공개] · Vultr · Expo project server
[비공개] · [비공개] (CF) · Cloudflare · Video CDN
[비공개] · (dead) · — · Previous landing (expired)
· Expo Server ([비공개]): Metro bundler dev server on port 8088, serving React Native bundles with source maps enabled
· C2 ([비공개]): JSON API server, Cloudflare-proxied, same operator as telegram_gallery/virbox_sens cluster
· Landing (CF): Static HTML with jQuery + Swiper.js, professional template
Location · Chinese Text · Translation
loadDeviceInfo · "加载设备信息失败" · "Failed to load device info"
sendContactsToServer · "发送数据失败" · "Failed to send data"
handleLogin · "请输入有效的手机号码" · "Please enter valid phone number"
handleLogin · "请求通讯录权限" · "Request contacts permission"
handleLogin · "获取通讯录" · "Get contacts"
handleLogin · "显示10秒的loading动画" · "Show 10-second loading animation"
handleLogin · "操作失败" · "Operation failed"
LoadingAnimation · "旋转动画" · "Rotation animation"
LoadingAnimation · "进度条动画" · "Progress bar animation"
· /www/wwwroot/p/expo/ — Baota Panel (宝塔面板) directory structure, common Chinese hosting panel
· Expo-based distribution via legitimate Expo Go app
· Contact theft via expo-contacts API
· Korean-targeted (phone number validation, Korean UI)
· Chinese developer (comments, server paths)
· Shares [비공개] C2 with telegram_gallery_2
· Same "Hello World!" root response
· Same API subdomain pattern
App · C2 · Pattern · Relationship
telegram_gallery_2 · [비공개] · Native Kotlin · Same C2
expogo_love3 · [비공개] · Expo · Same technique, different C2
glooryaq_new · [비공개] · Expo · Same distribution pattern
· [비공개] (landing page)
· [비공개] (C2)
· [비공개] (Expo server)
· [비공개] (video CDN)
· [비공개] (dead, previous landing)
· [비공개] (C2 real IP, leaked)
· [비공개] (Expo server, Vultr)
· [비공개] / [비공개] (C2 Cloudflare)
· [비공개] / [비공개] (landing Cloudflare)
· `[비공개] (data exfiltration endpoint)
· exp://[비공개] (Expo deep link)
· `[비공개]
· "BC Innovation" (1599-1401, contact@[비공개])
Mechanism · Description · Status
Cloudflare CDN · C2 and landing behind Cloudflare · Active (but IP leaked)
Expo Go Abuse · Legitimate app store presence via Expo Go · Active
Fake Error Message · "기기가 이 버전과 호환 되지 않습니다" · Active
Loading Animation · 10-second distraction while data exfiltrates · Active
Dev Mode Bundle · Source maps and dev=true exposed · OPSEC failure
1. Real IP Leaked: [비공개] endpoint returns [비공개]` in plaintext
2. Source Maps Enabled: Full source code recoverable from sourcemap_android.json (11.8MB)
3. Dev Mode Active: __DEV__=true in bundle, hot reload enabled
4. Chinese Comments: Developer language clearly visible in source
· Real IP [비공개] can be investigated for additional services
· Source maps reveal complete server directory structure (/www/wwwroot/p/expo/)
· Dead domain [비공개] may yield WHOIS history
```
Technique Assessment:
· Attempted: OA-094 (Expo Bundle Extraction), OA-095 (Source Map Recovery), SA-080 (React Native Decompilation), NW-062 (Typosquatting Domain Variants)
· Extended: OA-094 with Metro dev server direct access, NW-062 with real IP discovery via API endpoint leak
· New: NW-XXX (C2 Real IP Leak via API Endpoint) - [비공개] returns origin IP behind Cloudflare
· Limitations: Cannot access admin panel without credentials; Cloudflare blocks direct IP probing on C2
```
A user review on Expo Go (Google Play) explicitly warns: this app is used for webcam phishing (몸캠피싱). This confirms community awareness of the abuse pattern.
*Report generated: 2026-05-30*
*Analyst: Deep_Coding Research Lab*
본 보고서는 주식회사 아크링크 Deep-Coding 보안연구소가 피싱·몸캠피싱 피해자 구제를 목적으로 작성했습니다. 전체 열람·피해 상담: arklink.co.kr