Chinese State-Linked LightSpy Spyware Now Operating as Commercial Service Across 13 Countries

Arctic Wolf disclosed August 5, 2026, that LightSpy — first discovered in 2018 and linked to Chinese state-backed hackers — now runs as a commercial spyware-as-a-service with branding, billing, and product demos for government, enterprise, and military customers. The modular platform compromises smartphones, Apple devices, Linux servers, Windows PCs, and routers. It targets victims across 13 countries, including the United States. Attribution to a Chinese contractor followed an operator's KFC order placed via the admin panel using his real name.