Arctic Wolf researchers said LightSpy, a spyware program previously linked to Chinese state‑backed hackers and first identified in 2018, is now being used in attacks across more than a dozen countries, including the United States and several European nations.

The malware, initially discovered in 2018, has been adapted into a commercial platform marketed to governments, enterprises and militaries, offering custom branding and billing for prospective customers.

The platform is modular and can infect smartphones, Apple devices, Linux servers, Windows PCs and, more recently, routers, allowing attackers to access any device on the compromised network. It can exfiltrate precise location data, chat messages, screen recordings and stored passwords, and it includes a capability to remotely wipe data.

Arctic Wolf reported that the campaign operates a network of at least 117 servers in multiple countries. Some of the infected routers are associated with NATO member states. Researchers linked recent activity to a Chinese contractor after an operator used the LightSpy administrator panel to place an order with a Kentucky Fried Chicken restaurant using his real name and office address.

The expanding use of LightSpy underscores the growing availability of commercial spyware tools and the challenges they pose for global cybersecurity defenses.