The applications are disguised as tools created by activists to protests, said the firm, Lacoon Mobile Security.
The firm said that once downloaded, they give an outsider access to the phone's address book, call logs and other information.
The identities of victims and details of the servers used "lead us to believe that the Chinese government are behind the attack," said a Lacoon statement.
China is, along with the United States and Russia, regarded as a leader in cyber warfare research. Security experts say China is a leading source of hacking attacks aimed at foreign governments and companies to computers in China.
Also Read
Lacoon said it found two similar "malicious, fake" apps that appeared to be related. One targets phones that run Apple Inc.'s iOS operating system; the other is meant for phones using Google Inc.'s Android system.
The "very advanced software," known as an mRAT, or multidimensional requirements analysis tool, "is undoubtedly being backed by a nation state," the company said. Lacoon said it was calling the software Xsser.
"The Xsser mRAT represents a fundamental shift by nation-state cybercriminals from compromising traditional PC systems to targeting mobile devices," the company said.
In May, U.S. Prosecutors charged five Chinese military officers with cyberspying and stealing trade secrets from major American companies. A security firm, Mandiant, said last year it traced attacks on American and other companies to a military unit in Shanghai.