SecuriTricks - android

Prolific Zero-Day Exploits Continue

Despite sanctions, Intellexa continues to operate, developing and selling spyware to various clients. The company has been linked to 15 unique zero-day vulnerabilities since 2021, targeting mobile browsers and operating systems. Their exploit chain, known as 'smack', uses a framework called JSKit f…

ios

surveillance

Published: December 4, 2025

Linked vulnerabilities : CVE-2024-4610, CVE-2025-6554 (CVSS 8.1), CVE-2025-12480 (CVSS 9.1), CVE-2025-48543, CVE-2021-1048, CVE-2023-2136, CVE-2021-38003, CVE-2021-37976, CVE-2023-2033, CVE-2023-41993, CVE-2023-41992, CVE-2023-41991, CVE-2023-4762, CVE-2023-3079, CVE-2021-38000, CVE-2021-37973, CVE-2022-42856

Downloadable IOCs: 2

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets

Albiriox is a newly identified Android malware offered as Malware-as-a-Service, likely managed by Russian-speaking threat actors. It employs a two-stage deployment chain using dropper applications and packing techniques to evade detection. The malware exhibits advanced On-Device Fraud capabilities,…

Published: December 3, 2025

Downloadable IOCs: 0

Hidden Google Play Adware Drains Devices and Disrupts Millions of Users

A large-scale Android adware campaign dubbed 'GhostAd' has been uncovered, affecting millions of users primarily in East and Southeast Asia. The campaign involved multiple apps on Google Play that appeared harmless but created persistent background advertising engines, draining device resources and…

Published: November 27, 2025

Downloadable IOCs: 5

GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices

A sophisticated Android dropper impersonating the Google Play Store was discovered, distributing an app called 'GPT Trade'. This malicious application, disguised as an AI trading assistant, actually deploys two dangerous payloads: BTMob spyware and UASecurity Miner. The dropper creates directories,…

Published: November 19, 2025

Downloadable IOCs: 10

"Sneaky" new Android malware takes over your phone, hiding in fake news and ID apps

A sophisticated Android Trojan has been discovered that masquerades as trusted apps like news readers or digital ID applications. Once installed, it quietly operates in the background, stealing sensitive information such as login credentials and financial data. The malware exploits Android's Access…

accessibility services

2025-11-05

android/trojan.spy.banker.aur9b9b491bc44

Published: November 5, 2025

Downloadable IOCs: 0

Investigation Report: Android/BankBot-YNRK Mobile Banking Trojan

This report analyzes three Android APK samples identified as variants of the Android/BankBot-YNRK malware family. The malware exhibits sophisticated capabilities, including environment detection, persistence mechanisms, and extensive command-and-control functionalities. It abuses accessibility serv…

Published: October 31, 2025

Downloadable IOCs: 7

GHOSTGRAB ANDROID MALWARE

GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft. It exploits device resources for mining while harvesting sensitive information, including banking credentials, debit card details, and OTPs. The malware uses advanced persistence techniques, …

android

banking trojan

cryptocurrency mining

sms interception

2025-10-29

ghostgrab

Published: October 29, 2025

Downloadable IOCs: 9

New Android Malware Mimics Human Behavior to Evade Detection

A new Android malware called Herodotus has been discovered, designed to perform device takeover while mimicking human behavior to bypass biometric detection. Active campaigns have been observed in Italy and Brazil. Herodotus is being offered as Malware-as-a-Service and shows links to the previously…

Published: October 28, 2025

Downloadable IOCs: 1

Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

A coordinated spearphishing campaign targeted NGOs and Ukrainian government administrations involved in war relief efforts. The attack used emails impersonating the Ukrainian President's Office with weaponized PDFs, employing a fake Cloudflare captcha page to execute malware. The final payload was …

Published: October 22, 2025

Downloadable IOCs: 24

PhantomCaptcha: Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

A coordinated spearphishing campaign targeted NGOs and Ukrainian government administrations involved in war relief efforts. The attack used emails impersonating the Ukrainian President's Office with weaponized PDFs, employing a fake Cloudflare captcha page to execute malware. The final payload was …

Published: October 22, 2025

Downloadable IOCs: 0

New spyware campaigns target privacy-conscious Android users in the UAE

Two Android spyware campaigns, ProSpy and ToSpy, have been discovered targeting users in the United Arab Emirates. These campaigns impersonate secure messaging apps like Signal and ToTok, distributing malware through deceptive websites and social engineering tactics. Once installed, the spyware exf…

Published: October 2, 2025

Downloadable IOCs: 30

The Rise of RatOn: From NFC heists to remote control and ATS

A new Android banking trojan named RatOn has emerged, combining NFC relay attacks with remote access and automated transfer capabilities. Discovered by analysts monitoring the NFSkate threat group, RatOn targets cryptocurrency wallets and banking applications, particularly in the Czech Republic and…

Published: September 9, 2025

Downloadable IOCs: 23

SpyNote Malware Analysis

This analysis reveals the resurgence of SpyNote, a potent Android RAT, distributed through deceptive websites mimicking Google Play Store. The malware employs sophisticated techniques for surveillance, data exfiltration, and remote control. Recent changes include minor IP resolution adjustments and…

Published: August 27, 2025

Downloadable IOCs: 0

Android backdoor spies on Russian business employees

A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging…

android.backdoor.916.origin

targeted-attack

Published: August 25, 2025

Downloadable IOCs: 0

Android Document Readers and Deception: Tracking the Latest Updates to Anatsa

Anatsa, an Android banking malware first discovered in 2020, has evolved with new capabilities and targets. The latest variant now affects over 831 financial institutions worldwide, including new countries and cryptocurrency platforms. Anatsa has streamlined its payload delivery, implemented DES ru…

financial institutions

2025-08-22

harly

facestealer

Published: August 22, 2025

Downloadable IOCs: 0

MuddyWater Leveraging DCHSpy For Israel-Iran Conflict

Iranian cyber espionage group MuddyWater, affiliated with Iran's Ministry of Intelligence and Security, is utilizing DCHSpy, an Android surveillanceware tool, in the context of the Israel-Iran conflict. DCHSpy collects extensive data from infected devices, including WhatsApp data, accounts, contact…

Published: August 21, 2025

Linked vulnerabilities : CVE-2025-4609

Downloadable IOCs: 23

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT

A large-scale Malware-as-a-Service operation, orchestrated by Chinese-speaking threat actors, has infected over 11,000 Android devices globally with the PlayPraetor Remote Access Trojan. The campaign primarily targets Europe, with significant presence in Portugal, Spain, and France, but also affect…

accessibility services

2025-08-07

playpraetor

Published: August 7, 2025

Downloadable IOCs: 0

Behind Random Words: DoubleTrouble Mobile Banking Trojan Revealed

A sophisticated mobile banking trojan, DoubleTrouble, has evolved in distribution methods and capabilities. Initially spread through phishing websites impersonating European banks, it now utilizes Discord channels for distribution. The malware employs advanced obfuscation techniques, abuses Android…

mobile banking trojan

Published: August 1, 2025

Downloadable IOCs: 40

RedHook: A New Android Banking Trojan Targeting Users In Vietnam

A sophisticated Android banking trojan named RedHook has been discovered targeting Vietnamese users through spoofed government and financial websites. The malware uses WebSocket to communicate with its command-and-control server and supports over 30 remote commands, enabling complete control over c…

Published: July 31, 2025

Downloadable IOCs: 13

Android Malware Posing As Indian Bank Apps

This report analyzes a sophisticated Android malware targeting Indian banking apps. The malware uses a dropper and main payload structure, leveraging permissions like SMS access and silent installation to steal credentials, intercept messages, and perform unauthorized financial activities. It emplo…

Published: July 25, 2025

Downloadable IOCs: 2

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices

A new Android malware campaign has been discovered, disguising itself as a banking app to covertly mine cryptocurrency on locked devices. The malware, distributed through a phishing website impersonating Axis Bank, downloads and executes a modified version of XMRig, a popular cryptocurrency mining …

Published: July 18, 2025

Downloadable IOCs: 1

Konfety Returns: Classic Mobile Threat with New Evasion Techniques

A sophisticated variant of the Android malware Konfety has been identified, employing advanced evasion techniques. The malware uses dual-app deception, ZIP-level evasion, dynamic code loading, and stealth techniques to conduct ad fraud and redirect users to malicious websites. It tampers with the A…

ad fraud infrastructure

Published: July 16, 2025

Downloadable IOCs: 26

The new SparkKitty Trojan spy in the App Store and Google Play

A new spyware campaign dubbed SparkKitty has been discovered targeting both iOS and Android devices. The malware, believed to be connected to the previously identified SparkCat campaign, is distributed through official app stores and unofficial sources. It primarily steals photos from infected devi…

Published: June 23, 2025

Downloadable IOCs: 20

Caught in the Act: Uncovering SpyNote in Unexpected Places

Multiple samples of SpyNote, a sophisticated Android spyware, were discovered in open directories, disguised as legitimate apps like Google Translate, Temp Mail, and Deutsche Postbank. The malware exploits accessibility services and device administrator privileges to steal sensitive information fro…

accessibility services

2025-06-20

device administrator

malicious apps

Published: June 20, 2025

Downloadable IOCs: 2

Crypto Phishing Applications On The Play Store

An investigation uncovered more than 20 cryptocurrency phishing applications on the Google Play Store impersonating legitimate wallets like SushiSwap and PancakeSwap. These malicious apps employ phishing techniques to steal users' mnemonic phrases, allowing access to real wallets and theft of funds…

Published: June 20, 2025

Downloadable IOCs: 36

Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

HUMAN's Satori team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting over 1 million low-cost consumer devices worldwide. The scheme involves a backdoor pre-installed on devices or distributed through unofficial app marketplaces, allowing threat actors to conduct var…

Published: June 6, 2025

Downloadable IOCs: 969

Crocodilus Mobile Malware: Evolving Fast, Going Global

A new Android banking Trojan, Crocodilus, has rapidly evolved since its discovery in March 2025. Initially targeting Turkey, it has expanded to European countries and South America. The malware is distributed through malicious advertising on social networks, masquerading as banking and e-commerce a…

Published: June 3, 2025

Downloadable IOCs: 4

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber

APT36, also known as Transparent Tribe, has been observed using VPS provider Contabo to host malicious infrastructure for CapraRAT and Crimson RAT. Their latest tactic involves disguising spyware as the popular messaging app Viber, granting extensive permissions to record calls, read messages, and …

Published: June 3, 2025

Downloadable IOCs: 3

Evolution of Zanubis, a banking Trojan for Android

Zanubis is an evolving Android banking Trojan that emerged in 2022, targeting financial institutions in Peru before expanding to virtual cards and crypto wallets. It impersonates legitimate apps to trick users into granting accessibility permissions, enabling extensive data theft and device control…

Published: May 28, 2025

Downloadable IOCs: 8

Part 2: Compromised WordPress Pages and Malware Campaigns

This analysis focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. The threat actors used redirector scripts to target users from various countries, mimicking the Google Play Store. Additionally, the XWorm campaign tar…

Published: May 16, 2025

Downloadable IOCs: 45

A new version of Triada spreads embedded in the firmware of Android devices

Kaspersky researchers have discovered a new version of the Triada Trojan being distributed through infected Android device firmware. The malware is embedded into system files before devices are sold, making it nearly impossible to remove. It infects the Zygote process to compromise all apps on the …

Published: April 25, 2025

Downloadable IOCs: 0

SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation

A new Android malware campaign called 'SuperCard X' has been identified, employing NFC-relay techniques to enable fraudulent POS payments and ATM withdrawals. Distributed through a Chinese-speaking Malware-as-a-Service platform, it shares similarities with NGate malware. The campaign uses social en…

Published: April 18, 2025

Downloadable IOCs: 6

Proton66: Compromised WordPress Pages and Malware Campaigns

This intelligence briefing focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. It details how these sites were injected with malicious scripts to redirect Android users to fake Google Play Store pages. The report also…

Published: April 18, 2025

Downloadable IOCs: 48

Newly Registered Domains Distributing SpyNote Malware

Cybercriminals are employing deceptive websites on newly registered domains to distribute AndroidOS SpyNote malware. These sites imitate the Google Chrome install page on the Google Play Store, tricking users into downloading SpyNote, a powerful Android remote access trojan. SpyNote is used for sur…

Published: April 15, 2025

Downloadable IOCs: 0

North Korean APT37 Mobile Spyware Discovered

A new Android spyware called KoSpy has been attributed to the North Korean group APT37 (ScarCruft). The malware, active since March 2022, targets Korean and English-speaking users by masquerading as utility apps. KoSpy uses a two-stage C2 infrastructure, retrieving initial configurations from Fireb…

Published: April 12, 2025

Downloadable IOCs: 0

Beware! Fake 'NextGen mParivahan' Malware Returns

A new variant of the fake NextGen mParivahan malware has emerged, exhibiting enhanced stealth and data theft capabilities. The malware, disguised as a government traffic notification system, tricks users into downloading a malicious app that requests extensive permissions. This latest version targe…

Published: April 9, 2025

Downloadable IOCs: 0

Analysis of New Mobile Banking Malware

Salvador Stealer is a newly discovered Android malware that poses as a banking application to steal sensitive user information. It employs a multi-stage attack chain, utilizing a dropper APK to install the main payload. The malware incorporates a phishing website within the app to collect personal …

Published: April 1, 2025

Downloadable IOCs: 0

TsarBot Trojan Hits 750+ Banking & Crypto Apps!

A newly discovered Android banking Trojan, TsarBot, targets over 750 applications globally, including banking, finance, cryptocurrency, and e-commerce apps. It spreads through phishing sites masquerading as legitimate financial platforms and is installed via a dropper disguised as Google Play Servi…

Published: April 1, 2025

Downloadable IOCs: 0

PJobRAT makes a comeback, takes another crack at chat apps

In the latest campaign, X-Ops researchers found PJobRAT samples disguising themselves as instant messaging apps. In our telemetry, all the victims appeared to be based in Taiwan.

Published: March 27, 2025

Downloadable IOCs: 12

TURNING AID INTO ATTACK: EXPLOITATION OF PAKISTAN’S YOUTH LAPTOP SCHEME TO TARGET INDIA

A Pakistan-based APT group, assessed with medium confidence as APT36, who created a fake IndiaPost website to target and infect both Windows and Android users.

Published: March 27, 2025

Downloadable IOCs: 5

New Android Malware Campaigns Evading Detection Using Cross-Platform Framework .NET MAUI

Cybercriminals are exploiting .NET MAUI, a cross-platform development framework, to create Android malware that evades detection. These threats disguise themselves as legitimate apps, targeting users to steal sensitive information. The malware campaigns use techniques such as hiding code in blob fi…

Published: March 25, 2025

Downloadable IOCs: 13

Android trojan TgToxic updates its capabilities

TgToxic, an Android banking trojan, has undergone significant updates to enhance its capabilities and evade detection. Initially targeting Southeast Asia, the malware has expanded its reach to include European and Latin American banks. The latest version incorporates improved emulator detection tec…

Published: February 26, 2025

Downloadable IOCs: 0

SPYLEND: The Android App Available on Google Play Store: Enabling Financial Cyber Crime & Extortion

A sophisticated Android malware called SpyLend, disguised as a 'Finance Simplified' app, is targeting Indian users through the Google Play Store. The app leverages location-based targeting to display unauthorized loan applications, enabling predatory lending, blackmail, and extortion. It has rapidl…

Published: February 22, 2025

Downloadable IOCs: 0

FinStealer

A sophisticated malware campaign exploits a leading Indian bank's brand through fraudulent mobile applications. Distributed via phishing links and social engineering, these fake apps mimic legitimate bank apps, tricking users into revealing sensitive information. The malware uses advanced evasion t…

trojan.rewardsteal/joxpk

CVE-2011-2688

Published: February 17, 2025

Linked vulnerabilities : CVE-2011-2688

Downloadable IOCs: 5

SparkCat crypto stealer in Google Play and App Store

A new malware campaign dubbed 'SparkCat' has been discovered targeting Android and iOS users through both official and unofficial app stores. The malware, embedded in various apps, uses OCR technology to scan users' image galleries for crypto wallet recovery phrases. Infected Android apps on Google…

Published: February 6, 2025

Downloadable IOCs: 9

Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach

A mobile malware campaign targeting Indian banks has been uncovered, comprising nearly 900 samples aimed at Android devices. The malware, distributed via WhatsApp as fake government or banking apps, steals sensitive financial and personal data, including Aadhar and PAN card details, credit card inf…

Published: February 5, 2025

Downloadable IOCs: 891

Take my money: OCR crypto stealers in Google Play and App Store

Researchers discovered a new malware campaign dubbed 'SparkCat' targeting Android and iOS users through both official and unofficial app stores. The malware, embedded in various apps, uses OCR technology to scan users' image galleries for crypto wallet recovery phrases. Infected apps on Google Play…

Published: February 5, 2025

Downloadable IOCs: 0

Unpacking the BADBOX Botnet

The BADBOX botnet, a newly discovered threat, targets Android devices, including high-end models like Yandex 4K QLED TVs. Over 190,000 infected devices have been observed, with malware often pre-installed from the factory or further down the supply chain. Using Censys, a suspicious SSL/TLS certific…

Published: February 5, 2025

Downloadable IOCs: 19

Tria stealer targets Android users for SMS exfiltration and financial gain

Since mid-2024, a malicious Android campaign dubbed 'Tria Stealer' has been targeting users in Malaysia and Brunei using wedding invitation lures. The malware collects SMS data, call logs, messages from apps like WhatsApp, and email data from Gmail and Outlook. It exfiltrates this information to Te…

Published: January 30, 2025

Downloadable IOCs: 3

A closer look at the Tria stealer campaign

A malicious Android campaign named Tria Stealer has been targeting users in Malaysia and Brunei since mid-2024. The campaign uses wedding invitation lures to trick victims into installing a malicious app that collects SMS data, tracks call logs, and steals messages from apps like WhatsApp and email…

Published: January 30, 2025

Downloadable IOCs: 3

ANDROID MALWARE IN DONOT APT OPERATIONS

The DONOT APT group, serving Indian national interests, has deployed Android malware named 'Tanzeem' for intelligence gathering against internal threats. The malware, disguised as a chat application, exploits OneSignal, a customer engagement platform, for malicious purposes. It requests dangerous p…

Published: January 21, 2025

Downloadable IOCs: 6

BADBOX Botnet Is Back

The BADBOX botnet, previously thought to be contained, has resurfaced with increased scope and sophistication. Recent findings reveal over 192,000 infected devices, including high-end Yandex 4K QLED Smart TVs and Hisense smartphones, expanding beyond the initially targeted off-brand Android devices…

Published: December 17, 2024

Downloadable IOCs: 22

PlainGnome and Bonespy Russian Android spyware discovered | Threat Intel

Two Android surveillance families, BoneSpy and PlainGnome, have been discovered and attributed to the Russian Gamaredon APT group, associated with the FSB. BoneSpy, active since 2021, is based on open-source DroidWatcher, while PlainGnome emerged in 2024. Both target Russian-speaking victims in for…

Published: December 13, 2024

Downloadable IOCs: 31

AppLite: A New AntiDot Variant Targeting Mobile Employee Devices

A sophisticated Mishing campaign delivers malware to Android devices, enabling credential theft from banking, cryptocurrency, and critical applications. The campaign uses phishing domains to distribute a new variant of the Antidot banking trojan, dubbed AppLite Banker. Attackers pose as recruiters,…

Published: December 11, 2024

Downloadable IOCs: 224

Unidentified Threat Actor Utilizes Android Malware to Target High-Value Assets in South Asia

An unknown threat actor has deployed a malicious Android sample targeting high-value assets in Southern Asia. The malware, generated using the Spynote Remote Administration Tool, was delivered via WhatsApp in multiple attempts. The payload, concealed and operating in the background, exhibits variou…

rat

android

2024-12-10

Published: December 10, 2024

Downloadable IOCs: 5

DroidBot: Insights from a new Turkish MaaS fraud operation

DroidBot is an advanced Android Remote Access Trojan combining hidden VNC and overlay capabilities with spyware features. It uses dual-channel communication, transmitting data via MQTT and receiving commands through HTTPS. The malware targets 77 entities, including banks and cryptocurrency exchange…

Published: December 9, 2024

Downloadable IOCs: 5

Something to Remember Us By: Device Confiscated by Russian Authorities Returned with Monokle-Type Spyware Installed

A joint investigation by The First Department and The Citizen Lab uncovered spyware covertly implanted on a Russian programmer's phone after it was confiscated by authorities. The individual, accused of sending money to Ukraine, was subjected to beatings and recruitment attempts by the FSB during h…

Published: December 5, 2024

Downloadable IOCs: 0

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Earth Minotaur, a threat actor targeting Tibetan and Uyghur communities, utilizes the MOONSHINE exploit kit to compromise Android devices and install the DarkNimbus backdoor. The exploit kit targets vulnerabilities in instant messaging apps, particularly WeChat, and has been updated with new exploi…

Published: December 5, 2024

Downloadable IOCs: 0

ToxicPanda: a new banking trojan from Asia hit Europe and LATAM

A new Android banking Trojan called ToxicPanda has emerged, targeting Europe and Latin America. Originating from Chinese-speaking threat actors, it has infected over 1500 devices across Italy, Portugal, Spain, and other countries. ToxicPanda exploits accessibility services for account takeovers and…

chinese threat actors

Published: November 6, 2024

Downloadable IOCs: 19

G700: The Next Generation of Craxs RAT

G700 RAT, an advanced variant of Craxs RAT, targets Android devices and cryptocurrency applications. It employs sophisticated techniques like privilege escalation, phishing, and malicious APK distribution to infiltrate devices. The malware bypasses authentication, captures sensitive data, and manip…

transaction hijacking

sms interception

g700 rat

Published: November 4, 2024

Downloadable IOCs: 3

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Russian hackers, identified as UNC5812, are targeting the Ukrainian military through a sophisticated cyber operation. The attackers use a deceptive Telegram channel and website posing as a civil defense service to distribute malware for both Windows and Android devices. The Windows attack deploys P…

Published: October 31, 2024

Downloadable IOCs: 7

Rat King: How the Android Trojan CraxsRAT Steals User Data

CraxsRAT, an Android trojan, has been targeting Russian and Belarusian users since summer 2024. It masquerades as legitimate apps like government services, antivirus software, and telecom operators. The malware spreads through social engineering tactics, prompting users to download malicious APK fi…

Published: October 31, 2024

Downloadable IOCs: 0

Uncovering the Lounge Pass Scam Campaign: Targeted Android SMS Stealer Preying on Air Travellers

A sophisticated scam targeting air travelers in Indian airports has been uncovered, involving a malicious Android app called 'Lounge Pass'. The app, distributed through fake domains, intercepts and forwards SMS messages from victims' devices to cybercriminals, resulting in significant financial los…

Published: October 25, 2024

Downloadable IOCs: 0

Expanding the Investigation: Deep Dive into Latest TrickMo Samples

This report delves into the analysis of 40 recent variants of the banking trojan TrickMo, uncovering novel capabilities like stealing unlock patterns/PINs and geolocating victims. It examines the malware's advanced features, including credential theft, data exfiltration, and command-and-control mec…

Published: October 15, 2024

Downloadable IOCs: 94

Hidden in Plain Sight: ErrorFather’s Deadly Deployment of Cerberus

This report examines a campaign called 'ErrorFather' that utilizes an undetected variant of the Cerberus Android Banking Trojan. The campaign employed a sophisticated multi-stage dropper technique to deploy the malicious payload, which incorporated features like keylogging, overlay attacks, VNC, an…

Published: October 15, 2024

Downloadable IOCs: 20

Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users

A large-scale fraud campaign involving fake trading apps targeting Apple iOS and Android users across multiple regions has been uncovered. The apps, developed using the UniApp framework, were distributed through official app stores and phishing sites. Unlike conventional mobile trojans, these apps …

fraudulent trading apps

unishadowtrade

goldpickaxe

Published: October 4, 2024

Downloadable IOCs: 9

New Android Spyware Campaign Targets South Koreans via AWS

A sophisticated Android spyware campaign targeting South Koreans has been uncovered by Cyble Research and Intelligence Labs. Active since June 2024, the malware exploits an Amazon AWS S3 bucket as its Command and Control server to exfiltrate sensitive personal data including SMS messages, contacts,…

Published: October 1, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21893

Downloadable IOCs: 7

WalletConnect Scam: A Case Study in Crypto Drainer Tactics

An investigation uncovered a malicious app on Google Play targeting mobile users to steal cryptocurrency. The app, posing as a legitimate WalletConnect tool, used advanced evasion techniques to avoid detection for nearly five months. It achieved over 10,000 downloads through fake reviews and brandi…

Published: September 26, 2024

Downloadable IOCs: 6

Uncovering ICICI Phishing Campaign: New Fraud App Found

A malicious host mimicking ICICI Bank has been discovered, along with a fraudulent app disguised as ICICI Helpdesk. The phishing domain, cppcccare.com, is hosted on an ASN known for various malicious activities. The fraudulent app, named 'ICICI.apk', is detected as a Trojan Banker, Keylogger, and S…

Published: September 24, 2024

Downloadable IOCs: 3

Necro Trojan infiltrates Google Play and Spotify and WhatsApp mods

A new version of the Necro Trojan has infected various popular applications, including game mods and apps on Google Play, potentially affecting over 11 million Android devices. The multi-stage loader uses steganography to hide payloads and obfuscation to evade detection. Its modular architecture al…

Published: September 24, 2024

Downloadable IOCs: 6

Technical Analysis of Copybara

This report presents a comprehensive technical analysis of a newly discovered variant of the Copybara Android malware. The malware, which emerged in November 2021, is primarily spread through voice phishing attacks. It utilizes the MQTT protocol for command-and-control communication and abuses Andr…

android

2024-08-22

copybara

Published: August 22, 2024

Downloadable IOCs: 107

NGate Android malware relays NFC traffic to steal cash

ESET researchers uncovered a crimeware campaign targeting bank customers in Czechia. The NGate Android malware can relay NFC data from victims' payment cards to attackers' devices, enabling unauthorized ATM withdrawals. It's the first time this capability has been observed in the wild. The campaign…

Published: August 22, 2024

Downloadable IOCs: 12

Be careful what you wish for – Phishing in PWA applications

ESET analysts dissected a novel phishing method tailored to Android and iOS users, combining standard phishing delivery techniques with a novel approach of targeting mobile users via Progressive Web Applications (PWAs) and WebAPKs. Insidiously, installing these phishing PWAs and WebAPKs does not tr…

android

2024-08-21

Published: August 21, 2024

Downloadable IOCs: 8

BlankBot: A new Android banking trojan

A new Android banking trojan called BlankBot has been discovered. Discovered by Intel 471 researchers in July 2024, BlankBot primarily targets Turkish users through impersonated utility apps. With a range of malicious capabilities like customer injections, keylogging, screen recording, and remote c…

Published: August 6, 2024

Downloadable IOCs: 0

LianSpy: new Android spyware targeting Russian users

Kaspersky discovered an Android spyware campaign called LianSpy that targets Russian users. The malware can capture screencasts, exfiltrate files, and harvest call logs and app lists. It employs evasive tactics like using the Russian cloud service Yandex Disk for command and control communication, …

Published: August 6, 2024

Downloadable IOCs: 0

BingoMod: The new android RAT that steals money and wipes data

In late May 2024, a new Android Remote Access Trojan (RAT) named BingoMod emerged, aiming to initiate fraudulent money transfers from compromised devices using a technique called On-Device Fraud (ODF). After installation, BingoMod steals sensitive information, conducts overlay attacks, and provides…

Published: August 2, 2024

Downloadable IOCs: 3

New Mandrake Android spyware version discovered on Google Play

n April 2024, Securelist discovered a suspicious sample that appeared to be a new version of Mandrake. Ensuing analysis revealed as many as five Mandrake applications, which had been available on Google Play from 2022 to 2024 with more than 32,000 installs in total, while staying undetected by any …

Published: July 29, 2024

Downloadable IOCs: 9

GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

Group-IB discovered a Spanish-speaking criminal group, GXC Team, offering a sophisticated AI-powered phishing-as-a-service platform targeting Spanish bank customers. The group specialized in developing phishing kits, Android malware, and AI-powered scam tools. Their malicious Android app, disguised…

Published: July 29, 2024

Downloadable IOCs: 161

The tapestry of threats targeting Hamster Kombat players

This analysis delves into the various malicious threats capitalizing on the immense popularity of the Hamster Kombat mobile game. It reveals that cybercriminals are exploiting players' interests by distributing Android spyware disguised as the game through unofficial channels, as well as creating f…

android

spyware

2024-07-24

Published: July 24, 2024

Downloadable IOCs: 26

Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android

ESET researchers discovered a vulnerability named EvilVideo that allows attackers to share malicious Android payloads disguised as video files through Telegram for Android. The exploit makes the malicious files appear as multimedia content, tricking users into installing malware. The vulnerability …

Published: July 23, 2024

Downloadable IOCs: 1

Beware of BadPack: One Weird Trick Being Used Against Android Devices

The report examines the recent trend of BadPack Android malware, which utilizes tampered headers to obstruct analysis tools. It explores the effectiveness of various freely available utilities for analyzing BadPack Android Package Kit (APK) files. The report dissects the structure of APK files and …

Published: July 16, 2024

Downloadable IOCs: 4

CapraTube Remix | Android Spyware Targeting Gamers, Weapons Enthusiasts

SentinelLabs has uncovered a new campaign of Android spyware apps associated with the suspected Pakistan state-aligned Transparent Tribe threat group. The malicious apps, disguised as video browsers, gaming sites, and TikTok content, target mobile gamers, weapons enthusiasts, and individuals intere…

Published: July 1, 2024

Downloadable IOCs: 6

An Android RAT targets Telegram Users

This analysis discusses SpyMax, a Remote Access Trojan (RAT) that targets Android devices and specifically aims at obtaining data from Telegram users. It employs phishing techniques to trick victims into installing a malicious application disguised as the legitimate Telegram app. Once installed, Sp…

Published: June 28, 2024

Downloadable IOCs: 4

A New Compact Variant Discovered

Security researchers at Cleafy Labs detected a resurgence of the Medusa banking trojan, which targets Android devices for on-device fraud. The new variant exhibits a lightweight permission set, expanded geographical targeting, and the adoption of droppers for distribution. It introduces capabilitie…

Published: June 26, 2024

Downloadable IOCs: 50

RAFEL RAT, ANDROID MALWARE FROM ESPIONAGE TO RANSOMWARE OPERATIONS

Check Point Research has identified multiple threat actors utilizing Rafel, an open-source remote administration tool (RAT). The discovery of an espionage group leveraging Rafel in their operations was of particular significance, as it indicates the tool’s efficacy across various threat actor profi…

Published: June 20, 2024

Downloadable IOCs: 6

Arid Viper poisons Android apps with AridSpy

ESET researchers identified five campaigns targeting Android users with trojanized apps that deploy multistage Android spyware called AridSpy. This malware, attributed with medium confidence to the Arid Viper APT group, focuses on user data espionage. AridSpy downloads additional payloads from its …

Published: June 14, 2024

Downloadable IOCs: 37

Fake Bahrain Government Android App Steals Personal Data Used for Financial Fraud

An analysis by McAfee's Mobile Research Team uncovered an Android InfoStealer malware masquerading as a government service app in Bahrain. The malicious app, promoted through deceitful Facebook pages and SMS messages, tricks users into providing personal information like CPR numbers, phone numbers,…

Published: June 3, 2024

Downloadable IOCs: 14

Android Banking Malware Distributed via Google Play Store

Threat actors are distributing the Anatsa Android banking malware through the Google Play store by disguising it as legitimate applications like PDF readers and QR code scanners. Once installed, Anatsa downloads its payload and steals sensitive banking credentials through the use of overlays. Anats…

Published: May 28, 2024

Downloadable IOCs: 4

Technical Analysis of Anatsa Campaigns: An Android Banking Malware Active in the Google Play Store

Threat actors are distributing the Anatsa Android banking malware through the Google Play store by disguising it as legitimate applications like PDF readers and QR code scanners. Once installed, Anatsa downloads its payload and steals sensitive banking credentials through the use of overlays. Anats…

Published: May 28, 2024

Downloadable IOCs: 0

New Pakistan-based Cyber Espionage Group’s Year-Long Campaign Targeting Indian Defense Forces with Android Malware

CYFIRMA researchers identified an Android malware campaign, active for over a year, targeting Indian defense personnel by an unidentified Pakistan-based cyber espionage group. The threat actor utilized Spynote or a modified version called Craxs Rat, obfuscating the app with high complexity. Through…

Published: May 6, 2024

Downloadable IOCs: 3

SecretCalls: A Formidable App of Notorious Korean Financial Fraudster

Voice phishing groups in South Korea build phishing pages and apps like SecretCalls to trick victims into installing malware and accessing phishing sites for financial fraud. Detailed analysis of SecretCalls Loader reveals anti-analysis techniques like DEX encryption, emulator detection, and instal…

Published: May 3, 2024

Downloadable IOCs: 23

Playing Possum: What's the Backdoor Up To?

This report analyzes the Wpeeper backdoor targeting Android systems. Wpeeper utilizes compromised WordPress sites as relay C2 servers to hide its true C2. It uses HTTPS requests with Session fields to differentiate command types. Commands are encrypted with AES and signed to prevent takeover. Wpeep…

Published: May 3, 2024

Downloadable IOCs: 98

Tag: android

Attack reports

Prolific Zero-Day Exploits Continue

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets

Hidden Google Play Adware Drains Devices and Disrupts Millions of Users

GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices

Fantasy Hub: Another Russian Based RAT as Malware-as-a-Service

State-Sponsored Remote Wipe Tactics Targeting Android Devices

New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

"Sneaky" new Android malware takes over your phone, hiding in fake news and ID apps

Investigation Report: Android/BankBot-YNRK Mobile Banking Trojan

GHOSTGRAB ANDROID MALWARE

New Android Malware Mimics Human Behavior to Evade Detection

Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

PhantomCaptcha: Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

New spyware campaigns target privacy-conscious Android users in the UAE

The Rise of RatOn: From NFC heists to remote control and ATS

SpyNote Malware Analysis

Android backdoor spies on Russian business employees

Android Document Readers and Deception: Tracking the Latest Updates to Anatsa

MuddyWater Leveraging DCHSpy For Israel-Iran Conflict

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT

Behind Random Words: DoubleTrouble Mobile Banking Trojan Revealed

RedHook: A New Android Banking Trojan Targeting Users In Vietnam

Android Malware Posing As Indian Bank Apps

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices

Konfety Returns: Classic Mobile Threat with New Evasion Techniques

The new SparkKitty Trojan spy in the App Store and Google Play

Caught in the Act: Uncovering SpyNote in Unexpected Places

Crypto Phishing Applications On The Play Store

Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

Crocodilus Mobile Malware: Evolving Fast, Going Global

The Transparent Tribe Vibe: APT36 Returns With CapraRAT Impersonating Viber

Evolution of Zanubis, a banking Trojan for Android

Part 2: Compromised WordPress Pages and Malware Campaigns

A new version of Triada spreads embedded in the firmware of Android devices

SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation

Proton66: Compromised WordPress Pages and Malware Campaigns

Newly Registered Domains Distributing SpyNote Malware

North Korean APT37 Mobile Spyware Discovered

Beware! Fake 'NextGen mParivahan' Malware Returns

Analysis of New Mobile Banking Malware

TsarBot Trojan Hits 750+ Banking & Crypto Apps!

PJobRAT makes a comeback, takes another crack at chat apps

TURNING AID INTO ATTACK: EXPLOITATION OF PAKISTAN’S YOUTH LAPTOP SCHEME TO TARGET INDIA

New Android Malware Campaigns Evading Detection Using Cross-Platform Framework .NET MAUI

Android trojan TgToxic updates its capabilities

SPYLEND: The Android App Available on Google Play Store: Enabling Financial Cyber Crime & Extortion

FinStealer

SparkCat crypto stealer in Google Play and App Store

Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach

Take my money: OCR crypto stealers in Google Play and App Store

Unpacking the BADBOX Botnet

Tria stealer targets Android users for SMS exfiltration and financial gain

A closer look at the Tria stealer campaign

ANDROID MALWARE IN DONOT APT OPERATIONS

BADBOX Botnet Is Back

PlainGnome and Bonespy Russian Android spyware discovered | Threat Intel

AppLite: A New AntiDot Variant Targeting Mobile Employee Devices

Unidentified Threat Actor Utilizes Android Malware to Target High-Value Assets in South Asia

DroidBot: Insights from a new Turkish MaaS fraud operation

Something to Remember Us By: Device Confiscated by Russian Authorities Returned with Monokle-Type Spyware Installed

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

ToxicPanda: a new banking trojan from Asia hit Europe and LATAM

G700: The Next Generation of Craxs RAT

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Rat King: How the Android Trojan CraxsRAT Steals User Data

Uncovering the Lounge Pass Scam Campaign: Targeted Android SMS Stealer Preying on Air Travellers

Expanding the Investigation: Deep Dive into Latest TrickMo Samples

Hidden in Plain Sight: ErrorFather’s Deadly Deployment of Cerberus

Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users

New Android Spyware Campaign Targets South Koreans via AWS

WalletConnect Scam: A Case Study in Crypto Drainer Tactics

Uncovering ICICI Phishing Campaign: New Fraud App Found

Necro Trojan infiltrates Google Play and Spotify and WhatsApp mods

Technical Analysis of Copybara

NGate Android malware relays NFC traffic to steal cash

Be careful what you wish for – Phishing in PWA applications

BlankBot: A new Android banking trojan

LianSpy: new Android spyware targeting Russian users