{
  "family": "qqspy",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nQQSpy is a highly targeted information stealer and spyware family engineered specifically to compromise users of Tencent QQ, a massive instant messaging and social media platform widely used in Asia. Unlike generic keyloggers, QQSpy is explicitly designed to hook into the QQ application process, bypassing standard encryption to harvest chat logs, contact lists, and the user's primary login credentials.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nQQSpy is predominantly distributed via phishing links sent directly over QQ messenger from compromised accounts, or bundled within \"cracked\" game software and fake QQ \"add-ons\" on third-party download sites.\n\nOnce installed, QQSpy executes its targeted espionage routines:\n<ul>\n<li><strong>Process Injection and API Hooking:</strong> The spyware specifically searches the system for the active `QQ.exe` process. It injects its malicious DLL into this process and hooks the specific Windows APIs used by QQ for keyboard input and screen rendering, allowing it to intercept passwords before they are securely hashed by the client.</li>\n<li><strong>Data Exfiltration:</strong> QQSpy aggressively harvests chat histories, transferred files, and contact lists. It compiles this data into hidden, encrypted archives and periodically transmits it to a remote command-and-control (C2) server.</li>\n<li><strong>Account Hijacking:</strong> By stealing the primary QQ token or password, the attacker can hijack the account. This hijacked account is then used to propagate the malware to the victim's contacts, lending an air of legitimacy to the phishing links.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA QQSpy infection is a severe privacy and security breach. Because QQ is often linked to other services (like QQ Pay and enterprise communications in certain regions), the theft of these credentials can lead directly to financial loss and the compromise of sensitive corporate data.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Password Reset:</strong> Assume the QQ account is fully compromised. The user must immediately reset their QQ password from a known-clean device and forcefully terminate all active sessions within the QQ security center.</li>\n<li><strong>Endpoint Scanning:</strong> Utilize an enterprise-grade anti-malware solution to perform a deep system scan. QQSpy often uses Rootkit techniques to hide its injected DLLs, requiring advanced behavioral analysis for complete removal.</li>\n<li><strong>Network Monitoring:</strong> Analyze network traffic for unauthorized connections to known C2 domains associated with this spyware family to identify potentially compromised endpoints across the network.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Spyware.QQSpy",
    "Trojan.PWS.QQPass",
    "Win32/QQSpy"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1055.001",
    "T1113",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:02:47Z",
  "type": "Spyware / Keylogger",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}