SecuriTricks - android

TURNING AID INTO ATTACK: EXPLOITATION OF PAKISTAN’S YOUTH LAPTOP SCHEME TO TARGET INDIA

A Pakistan-based APT group, assessed with medium confidence as APT36, who created a fake IndiaPost website to target and infect both Windows and Android users.

python

android

Published: March 27, 2025

Downloadable IOCs: 5

New Android Malware Campaigns Evading Detection Using Cross-Platform Framework .NET MAUI

Cybercriminals are exploiting .NET MAUI, a cross-platform development framework, to create Android malware that evades detection. These threats disguise themselves as legitimate apps, targeting users to steal sensitive information. The malware campaigns use techniques such as hiding code in blob fi…

Published: March 25, 2025

Downloadable IOCs: 13

Android trojan TgToxic updates its capabilities

TgToxic, an Android banking trojan, has undergone significant updates to enhance its capabilities and evade detection. Initially targeting Southeast Asia, the malware has expanded its reach to include European and Latin American banks. The latest version incorporates improved emulator detection tec…

Published: February 26, 2025

Downloadable IOCs: 0

SPYLEND: The Android App Available on Google Play Store: Enabling Financial Cyber Crime & Extortion

A sophisticated Android malware called SpyLend, disguised as a 'Finance Simplified' app, is targeting Indian users through the Google Play Store. The app leverages location-based targeting to display unauthorized loan applications, enabling predatory lending, blackmail, and extortion. It has rapidl…

Published: February 22, 2025

Downloadable IOCs: 0

FinStealer

A sophisticated malware campaign exploits a leading Indian bank's brand through fraudulent mobile applications. Distributed via phishing links and social engineering, these fake apps mimic legitimate bank apps, tricking users into revealing sensitive information. The malware uses advanced evasion t…

trojan.rewardsteal/joxpk

CVE-2011-2688

Published: February 17, 2025

Linked vulnerabilities : CVE-2011-2688

Downloadable IOCs: 5

SparkCat crypto stealer in Google Play and App Store

A new malware campaign dubbed 'SparkCat' has been discovered targeting Android and iOS users through both official and unofficial app stores. The malware, embedded in various apps, uses OCR technology to scan users' image galleries for crypto wallet recovery phrases. Infected Android apps on Google…

Published: February 6, 2025

Downloadable IOCs: 9

Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach

A mobile malware campaign targeting Indian banks has been uncovered, comprising nearly 900 samples aimed at Android devices. The malware, distributed via WhatsApp as fake government or banking apps, steals sensitive financial and personal data, including Aadhar and PAN card details, credit card inf…

Published: February 5, 2025

Downloadable IOCs: 891

Take my money: OCR crypto stealers in Google Play and App Store

Researchers discovered a new malware campaign dubbed 'SparkCat' targeting Android and iOS users through both official and unofficial app stores. The malware, embedded in various apps, uses OCR technology to scan users' image galleries for crypto wallet recovery phrases. Infected apps on Google Play…

Published: February 5, 2025

Downloadable IOCs: 0

Unpacking the BADBOX Botnet

The BADBOX botnet, a newly discovered threat, targets Android devices, including high-end models like Yandex 4K QLED TVs. Over 190,000 infected devices have been observed, with malware often pre-installed from the factory or further down the supply chain. Using Censys, a suspicious SSL/TLS certific…

Published: February 5, 2025

Downloadable IOCs: 19

Tria stealer targets Android users for SMS exfiltration and financial gain

Since mid-2024, a malicious Android campaign dubbed 'Tria Stealer' has been targeting users in Malaysia and Brunei using wedding invitation lures. The malware collects SMS data, call logs, messages from apps like WhatsApp, and email data from Gmail and Outlook. It exfiltrates this information to Te…

Published: January 30, 2025

Downloadable IOCs: 3

A closer look at the Tria stealer campaign

A malicious Android campaign named Tria Stealer has been targeting users in Malaysia and Brunei since mid-2024. The campaign uses wedding invitation lures to trick victims into installing a malicious app that collects SMS data, tracks call logs, and steals messages from apps like WhatsApp and email…

Published: January 30, 2025

Downloadable IOCs: 3

ANDROID MALWARE IN DONOT APT OPERATIONS

The DONOT APT group, serving Indian national interests, has deployed Android malware named 'Tanzeem' for intelligence gathering against internal threats. The malware, disguised as a chat application, exploits OneSignal, a customer engagement platform, for malicious purposes. It requests dangerous p…

Published: January 21, 2025

Downloadable IOCs: 6

BADBOX Botnet Is Back

The BADBOX botnet, previously thought to be contained, has resurfaced with increased scope and sophistication. Recent findings reveal over 192,000 infected devices, including high-end Yandex 4K QLED Smart TVs and Hisense smartphones, expanding beyond the initially targeted off-brand Android devices…

Published: December 17, 2024

Downloadable IOCs: 22

PlainGnome and Bonespy Russian Android spyware discovered | Threat Intel

Two Android surveillance families, BoneSpy and PlainGnome, have been discovered and attributed to the Russian Gamaredon APT group, associated with the FSB. BoneSpy, active since 2021, is based on open-source DroidWatcher, while PlainGnome emerged in 2024. Both target Russian-speaking victims in for…

Published: December 13, 2024

Downloadable IOCs: 31

AppLite: A New AntiDot Variant Targeting Mobile Employee Devices

A sophisticated Mishing campaign delivers malware to Android devices, enabling credential theft from banking, cryptocurrency, and critical applications. The campaign uses phishing domains to distribute a new variant of the Antidot banking trojan, dubbed AppLite Banker. Attackers pose as recruiters,…

Published: December 11, 2024

Downloadable IOCs: 224

Unidentified Threat Actor Utilizes Android Malware to Target High-Value Assets in South Asia

An unknown threat actor has deployed a malicious Android sample targeting high-value assets in Southern Asia. The malware, generated using the Spynote Remote Administration Tool, was delivered via WhatsApp in multiple attempts. The payload, concealed and operating in the background, exhibits variou…

rat

android

2024-12-10

Published: December 10, 2024

Downloadable IOCs: 5

DroidBot: Insights from a new Turkish MaaS fraud operation

DroidBot is an advanced Android Remote Access Trojan combining hidden VNC and overlay capabilities with spyware features. It uses dual-channel communication, transmitting data via MQTT and receiving commands through HTTPS. The malware targets 77 entities, including banks and cryptocurrency exchange…

Published: December 9, 2024

Downloadable IOCs: 5

Something to Remember Us By: Device Confiscated by Russian Authorities Returned with Monokle-Type Spyware Installed

A joint investigation by The First Department and The Citizen Lab uncovered spyware covertly implanted on a Russian programmer's phone after it was confiscated by authorities. The individual, accused of sending money to Ukraine, was subjected to beatings and recruitment attempts by the FSB during h…

Published: December 5, 2024

Downloadable IOCs: 0

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

Earth Minotaur, a threat actor targeting Tibetan and Uyghur communities, utilizes the MOONSHINE exploit kit to compromise Android devices and install the DarkNimbus backdoor. The exploit kit targets vulnerabilities in instant messaging apps, particularly WeChat, and has been updated with new exploi…

Published: December 5, 2024

Downloadable IOCs: 0

ToxicPanda: a new banking trojan from Asia hit Europe and LATAM

A new Android banking Trojan called ToxicPanda has emerged, targeting Europe and Latin America. Originating from Chinese-speaking threat actors, it has infected over 1500 devices across Italy, Portugal, Spain, and other countries. ToxicPanda exploits accessibility services for account takeovers and…

chinese threat actors

Published: November 6, 2024

Downloadable IOCs: 19

G700: The Next Generation of Craxs RAT

G700 RAT, an advanced variant of Craxs RAT, targets Android devices and cryptocurrency applications. It employs sophisticated techniques like privilege escalation, phishing, and malicious APK distribution to infiltrate devices. The malware bypasses authentication, captures sensitive data, and manip…

transaction hijacking

sms interception

g700 rat

Published: November 4, 2024

Downloadable IOCs: 3

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Russian hackers, identified as UNC5812, are targeting the Ukrainian military through a sophisticated cyber operation. The attackers use a deceptive Telegram channel and website posing as a civil defense service to distribute malware for both Windows and Android devices. The Windows attack deploys P…

Published: October 31, 2024

Downloadable IOCs: 7

Rat King: How the Android Trojan CraxsRAT Steals User Data

CraxsRAT, an Android trojan, has been targeting Russian and Belarusian users since summer 2024. It masquerades as legitimate apps like government services, antivirus software, and telecom operators. The malware spreads through social engineering tactics, prompting users to download malicious APK fi…

Published: October 31, 2024

Downloadable IOCs: 0

Uncovering the Lounge Pass Scam Campaign: Targeted Android SMS Stealer Preying on Air Travellers

A sophisticated scam targeting air travelers in Indian airports has been uncovered, involving a malicious Android app called 'Lounge Pass'. The app, distributed through fake domains, intercepts and forwards SMS messages from victims' devices to cybercriminals, resulting in significant financial los…

Published: October 25, 2024

Downloadable IOCs: 0

Expanding the Investigation: Deep Dive into Latest TrickMo Samples

This report delves into the analysis of 40 recent variants of the banking trojan TrickMo, uncovering novel capabilities like stealing unlock patterns/PINs and geolocating victims. It examines the malware's advanced features, including credential theft, data exfiltration, and command-and-control mec…

Published: October 15, 2024

Downloadable IOCs: 94

Hidden in Plain Sight: ErrorFather’s Deadly Deployment of Cerberus

This report examines a campaign called 'ErrorFather' that utilizes an undetected variant of the Cerberus Android Banking Trojan. The campaign employed a sophisticated multi-stage dropper technique to deploy the malicious payload, which incorporated features like keylogging, overlay attacks, VNC, an…

Published: October 15, 2024

Downloadable IOCs: 20

Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users

A large-scale fraud campaign involving fake trading apps targeting Apple iOS and Android users across multiple regions has been uncovered. The apps, developed using the UniApp framework, were distributed through official app stores and phishing sites. Unlike conventional mobile trojans, these apps …

fraudulent trading apps

unishadowtrade

goldpickaxe

Published: October 4, 2024

Downloadable IOCs: 9

New Android Spyware Campaign Targets South Koreans via AWS

A sophisticated Android spyware campaign targeting South Koreans has been uncovered by Cyble Research and Intelligence Labs. Active since June 2024, the malware exploits an Amazon AWS S3 bucket as its Command and Control server to exfiltrate sensitive personal data including SMS messages, contacts,…

Published: October 1, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21893

Downloadable IOCs: 7

WalletConnect Scam: A Case Study in Crypto Drainer Tactics

An investigation uncovered a malicious app on Google Play targeting mobile users to steal cryptocurrency. The app, posing as a legitimate WalletConnect tool, used advanced evasion techniques to avoid detection for nearly five months. It achieved over 10,000 downloads through fake reviews and brandi…

Published: September 26, 2024

Downloadable IOCs: 6

Uncovering ICICI Phishing Campaign: New Fraud App Found

A malicious host mimicking ICICI Bank has been discovered, along with a fraudulent app disguised as ICICI Helpdesk. The phishing domain, cppcccare.com, is hosted on an ASN known for various malicious activities. The fraudulent app, named 'ICICI.apk', is detected as a Trojan Banker, Keylogger, and S…

Published: September 24, 2024

Downloadable IOCs: 3

Necro Trojan infiltrates Google Play and Spotify and WhatsApp mods

A new version of the Necro Trojan has infected various popular applications, including game mods and apps on Google Play, potentially affecting over 11 million Android devices. The multi-stage loader uses steganography to hide payloads and obfuscation to evade detection. Its modular architecture al…

Published: September 24, 2024

Downloadable IOCs: 6

Technical Analysis of Copybara

This report presents a comprehensive technical analysis of a newly discovered variant of the Copybara Android malware. The malware, which emerged in November 2021, is primarily spread through voice phishing attacks. It utilizes the MQTT protocol for command-and-control communication and abuses Andr…

android

2024-08-22

copybara

Published: August 22, 2024

Downloadable IOCs: 107

NGate Android malware relays NFC traffic to steal cash

ESET researchers uncovered a crimeware campaign targeting bank customers in Czechia. The NGate Android malware can relay NFC data from victims' payment cards to attackers' devices, enabling unauthorized ATM withdrawals. It's the first time this capability has been observed in the wild. The campaign…

Published: August 22, 2024

Downloadable IOCs: 12

Be careful what you wish for – Phishing in PWA applications

ESET analysts dissected a novel phishing method tailored to Android and iOS users, combining standard phishing delivery techniques with a novel approach of targeting mobile users via Progressive Web Applications (PWAs) and WebAPKs. Insidiously, installing these phishing PWAs and WebAPKs does not tr…

android

2024-08-21

Published: August 21, 2024

Downloadable IOCs: 8

BlankBot: A new Android banking trojan

A new Android banking trojan called BlankBot has been discovered. Discovered by Intel 471 researchers in July 2024, BlankBot primarily targets Turkish users through impersonated utility apps. With a range of malicious capabilities like customer injections, keylogging, screen recording, and remote c…

Published: August 6, 2024

Downloadable IOCs: 0

LianSpy: new Android spyware targeting Russian users

Kaspersky discovered an Android spyware campaign called LianSpy that targets Russian users. The malware can capture screencasts, exfiltrate files, and harvest call logs and app lists. It employs evasive tactics like using the Russian cloud service Yandex Disk for command and control communication, …

Published: August 6, 2024

Downloadable IOCs: 0

BingoMod: The new android RAT that steals money and wipes data

In late May 2024, a new Android Remote Access Trojan (RAT) named BingoMod emerged, aiming to initiate fraudulent money transfers from compromised devices using a technique called On-Device Fraud (ODF). After installation, BingoMod steals sensitive information, conducts overlay attacks, and provides…

Published: August 2, 2024

Downloadable IOCs: 3

New Mandrake Android spyware version discovered on Google Play

n April 2024, Securelist discovered a suspicious sample that appeared to be a new version of Mandrake. Ensuing analysis revealed as many as five Mandrake applications, which had been available on Google Play from 2022 to 2024 with more than 32,000 installs in total, while staying undetected by any …

Published: July 29, 2024

Downloadable IOCs: 9

GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

Group-IB discovered a Spanish-speaking criminal group, GXC Team, offering a sophisticated AI-powered phishing-as-a-service platform targeting Spanish bank customers. The group specialized in developing phishing kits, Android malware, and AI-powered scam tools. Their malicious Android app, disguised…

Published: July 29, 2024

Downloadable IOCs: 161

The tapestry of threats targeting Hamster Kombat players

This analysis delves into the various malicious threats capitalizing on the immense popularity of the Hamster Kombat mobile game. It reveals that cybercriminals are exploiting players' interests by distributing Android spyware disguised as the game through unofficial channels, as well as creating f…

android

spyware

2024-07-24

Published: July 24, 2024

Downloadable IOCs: 26

Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android

ESET researchers discovered a vulnerability named EvilVideo that allows attackers to share malicious Android payloads disguised as video files through Telegram for Android. The exploit makes the malicious files appear as multimedia content, tricking users into installing malware. The vulnerability …

Published: July 23, 2024

Downloadable IOCs: 1

Beware of BadPack: One Weird Trick Being Used Against Android Devices

The report examines the recent trend of BadPack Android malware, which utilizes tampered headers to obstruct analysis tools. It explores the effectiveness of various freely available utilities for analyzing BadPack Android Package Kit (APK) files. The report dissects the structure of APK files and …

Published: July 16, 2024

Downloadable IOCs: 4

CapraTube Remix | Android Spyware Targeting Gamers, Weapons Enthusiasts

SentinelLabs has uncovered a new campaign of Android spyware apps associated with the suspected Pakistan state-aligned Transparent Tribe threat group. The malicious apps, disguised as video browsers, gaming sites, and TikTok content, target mobile gamers, weapons enthusiasts, and individuals intere…

Published: July 1, 2024

Downloadable IOCs: 6

An Android RAT targets Telegram Users

This analysis discusses SpyMax, a Remote Access Trojan (RAT) that targets Android devices and specifically aims at obtaining data from Telegram users. It employs phishing techniques to trick victims into installing a malicious application disguised as the legitimate Telegram app. Once installed, Sp…

Published: June 28, 2024

Downloadable IOCs: 4

A New Compact Variant Discovered

Security researchers at Cleafy Labs detected a resurgence of the Medusa banking trojan, which targets Android devices for on-device fraud. The new variant exhibits a lightweight permission set, expanded geographical targeting, and the adoption of droppers for distribution. It introduces capabilitie…

Published: June 26, 2024

Downloadable IOCs: 50

RAFEL RAT, ANDROID MALWARE FROM ESPIONAGE TO RANSOMWARE OPERATIONS

Check Point Research has identified multiple threat actors utilizing Rafel, an open-source remote administration tool (RAT). The discovery of an espionage group leveraging Rafel in their operations was of particular significance, as it indicates the tool’s efficacy across various threat actor profi…

Published: June 20, 2024

Downloadable IOCs: 6

Arid Viper poisons Android apps with AridSpy

ESET researchers identified five campaigns targeting Android users with trojanized apps that deploy multistage Android spyware called AridSpy. This malware, attributed with medium confidence to the Arid Viper APT group, focuses on user data espionage. AridSpy downloads additional payloads from its …

Published: June 14, 2024

Downloadable IOCs: 37

Fake Bahrain Government Android App Steals Personal Data Used for Financial Fraud

An analysis by McAfee's Mobile Research Team uncovered an Android InfoStealer malware masquerading as a government service app in Bahrain. The malicious app, promoted through deceitful Facebook pages and SMS messages, tricks users into providing personal information like CPR numbers, phone numbers,…

Published: June 3, 2024

Downloadable IOCs: 14

Android Banking Malware Distributed via Google Play Store

Threat actors are distributing the Anatsa Android banking malware through the Google Play store by disguising it as legitimate applications like PDF readers and QR code scanners. Once installed, Anatsa downloads its payload and steals sensitive banking credentials through the use of overlays. Anats…

Published: May 28, 2024

Downloadable IOCs: 4

Technical Analysis of Anatsa Campaigns: An Android Banking Malware Active in the Google Play Store

Threat actors are distributing the Anatsa Android banking malware through the Google Play store by disguising it as legitimate applications like PDF readers and QR code scanners. Once installed, Anatsa downloads its payload and steals sensitive banking credentials through the use of overlays. Anats…

Published: May 28, 2024

Downloadable IOCs: 0

New Pakistan-based Cyber Espionage Group’s Year-Long Campaign Targeting Indian Defense Forces with Android Malware

CYFIRMA researchers identified an Android malware campaign, active for over a year, targeting Indian defense personnel by an unidentified Pakistan-based cyber espionage group. The threat actor utilized Spynote or a modified version called Craxs Rat, obfuscating the app with high complexity. Through…

Published: May 6, 2024

Downloadable IOCs: 3

SecretCalls: A Formidable App of Notorious Korean Financial Fraudster

Voice phishing groups in South Korea build phishing pages and apps like SecretCalls to trick victims into installing malware and accessing phishing sites for financial fraud. Detailed analysis of SecretCalls Loader reveals anti-analysis techniques like DEX encryption, emulator detection, and instal…

Published: May 3, 2024

Downloadable IOCs: 23

Playing Possum: What's the Backdoor Up To?

This report analyzes the Wpeeper backdoor targeting Android systems. Wpeeper utilizes compromised WordPress sites as relay C2 servers to hide its true C2. It uses HTTPS requests with Session fields to differentiate command types. Commands are encrypted with AES and signed to prevent takeover. Wpeep…

Published: May 3, 2024

Downloadable IOCs: 98

Tag: android

Attack reports

Newly Registered Domains Distributing SpyNote Malware

North Korean APT37 Mobile Spyware Discovered

Beware! Fake 'NextGen mParivahan' Malware Returns

Analysis of New Mobile Banking Malware

TsarBot Trojan Hits 750+ Banking & Crypto Apps!

PJobRAT makes a comeback, takes another crack at chat apps

TURNING AID INTO ATTACK: EXPLOITATION OF PAKISTAN’S YOUTH LAPTOP SCHEME TO TARGET INDIA

New Android Malware Campaigns Evading Detection Using Cross-Platform Framework .NET MAUI

Android trojan TgToxic updates its capabilities

SPYLEND: The Android App Available on Google Play Store: Enabling Financial Cyber Crime & Extortion

FinStealer

SparkCat crypto stealer in Google Play and App Store

Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach

Take my money: OCR crypto stealers in Google Play and App Store

Unpacking the BADBOX Botnet

Tria stealer targets Android users for SMS exfiltration and financial gain

A closer look at the Tria stealer campaign

ANDROID MALWARE IN DONOT APT OPERATIONS

BADBOX Botnet Is Back

PlainGnome and Bonespy Russian Android spyware discovered | Threat Intel

AppLite: A New AntiDot Variant Targeting Mobile Employee Devices

Unidentified Threat Actor Utilizes Android Malware to Target High-Value Assets in South Asia

DroidBot: Insights from a new Turkish MaaS fraud operation

Something to Remember Us By: Device Confiscated by Russian Authorities Returned with Monokle-Type Spyware Installed

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur's Multi-Platform Attacks

ToxicPanda: a new banking trojan from Asia hit Europe and LATAM

G700: The Next Generation of Craxs RAT

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Rat King: How the Android Trojan CraxsRAT Steals User Data

Uncovering the Lounge Pass Scam Campaign: Targeted Android SMS Stealer Preying on Air Travellers

Expanding the Investigation: Deep Dive into Latest TrickMo Samples

Hidden in Plain Sight: ErrorFather’s Deadly Deployment of Cerberus

Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users

New Android Spyware Campaign Targets South Koreans via AWS

WalletConnect Scam: A Case Study in Crypto Drainer Tactics

Uncovering ICICI Phishing Campaign: New Fraud App Found

Necro Trojan infiltrates Google Play and Spotify and WhatsApp mods

Technical Analysis of Copybara

NGate Android malware relays NFC traffic to steal cash

Be careful what you wish for – Phishing in PWA applications

BlankBot: A new Android banking trojan

LianSpy: new Android spyware targeting Russian users

BingoMod: The new android RAT that steals money and wipes data

New Mandrake Android spyware version discovered on Google Play

GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

The tapestry of threats targeting Hamster Kombat players

Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android

Beware of BadPack: One Weird Trick Being Used Against Android Devices

CapraTube Remix | Android Spyware Targeting Gamers, Weapons Enthusiasts

An Android RAT targets Telegram Users

A New Compact Variant Discovered

RAFEL RAT, ANDROID MALWARE FROM ESPIONAGE TO RANSOMWARE OPERATIONS

Arid Viper poisons Android apps with AridSpy

Fake Bahrain Government Android App Steals Personal Data Used for Financial Fraud

Android Banking Malware Distributed via Google Play Store

Technical Analysis of Anatsa Campaigns: An Android Banking Malware Active in the Google Play Store

New Pakistan-based Cyber Espionage Group’s Year-Long Campaign Targeting Indian Defense Forces with Android Malware

SecretCalls: A Formidable App of Notorious Korean Financial Fraudster

Playing Possum: What's the Backdoor Up To?