The Earth Minotaur threat actor is leveraging the MOONSHINE exploit kit to target vulnerabilities in Android messaging applications. This leads to the installation of the DarkNimbus Android backdoor, enabling long-term surveillance. The MOONSHINE kit exploits vulnerabilities within messaging apps to gain initial access.