Tag: accessibility services

4 Attack Reports | 0 Vulnerabilities

Attack reports

"Sneaky" new Android malware takes over your phone, hiding in fake news and ID apps

A sophisticated Android Trojan has been discovered that masquerades as trusted apps like news readers or digital ID applications. Once installed, it quietly operates in the background, stealing sensitive information such as login credentials and financial data. The malware exploits Android's Access…
android
cryptocurrency
trojan
banking malware
southeast asia
overlay attack
accessibility services
2025-11-05
android/trojan.spy.banker.aur9b9b491bc44
Published: November 5, 2025
Downloadable IOCs: 0

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT

A large-scale Malware-as-a-Service operation, orchestrated by Chinese-speaking threat actors, has infected over 11,000 Android devices globally with the PlayPraetor Remote Access Trojan. The campaign primarily targets Europe, with significant presence in Portugal, Spain, and France, but also affect…
rat
android
cryptocurrency
botnet
banking
maas
accessibility services
2025-08-07
playpraetor
Published: August 7, 2025
Downloadable IOCs: 0

Caught in the Act: Uncovering SpyNote in Unexpected Places

Multiple samples of SpyNote, a sophisticated Android spyware, were discovered in open directories, disguised as legitimate apps like Google Translate, Temp Mail, and Deutsche Postbank. The malware exploits accessibility services and device administrator privileges to steal sensitive information fro…
android
spyware
spynote
data exfiltration
c2 infrastructure
open directories
accessibility services
2025-06-20
device administrator
malicious apps
Published: June 20, 2025
Downloadable IOCs: 2

Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer

A new malware called DocSwap, disguised as a document viewing authentication app, was discovered targeting South Korean mobile users. The malware, linked to a North Korean APT group, performs keylogging and information theft through accessibility services. It decrypts an obfuscated APK file, execut…
apt
north korea
south korea
2025-04-12
dpkr
docswap
accessibility services
Published: April 12, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports