Transparent Tribe actors have unveiled a new campaign targeting Android users throughout India and Pakistan. Historically, Transparent Tribe (APT36) is known for their continuous cyberespionage attacks against research, defense, and diplomatic organizations in Afghanistan and India for nearly a decade. This new campaign has set sights on Indian and Pakistani Android users who are involved with military or political operations in the region. Users are contacted on common messaging platforms and are lured via romance scams to download and install another messaging platform laced with malicious software. Transparent Tribe actors embedded malicious code into the applications (MeetsApp and MeetUp) to install the “CapraRAT” backdoor, one (1) of their more commonly used malwares in previous campaigns. Once installed, CapraRAT has the capabilities to exfiltrate sensitive information, make phone calls, record phone call audio, capture screenshots, and send SMS text messages. Communications from both malicious applications relay back to the same command-and-control (C2) server and contain the same digital certificates. Personal identifiable information (PII) of around 150 victims were obtained and analyzed by researchers due to weak security by the threat actors. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.