Topic
Malicious Android applications, including remote access trojans and second-stage payloads installed on victim devices.
CERT Polska found that Messenger Pro cleared Google Play review as a 40MB base APK whose malicious loader was 0.552% of its code. Its real payload never shipped to the store; stage two pulled it from an Alibaba Cloud bucket only after install.
Reality
Ukraine's SSSCIP says Russian hackers are going after military and government phones, using hacked news and government sites to push the DarkSword iPhone kit. Because the kit needs little or no action from the victim, the defense falls on the phone's own software and how current it is.
Reality
Group-IB says a 13-minute call ended with a loan in the victim's name and card data streaming to a fake merchant terminal, every transaction approved with the victim's own PIN.
Perspective Coverage
3 publishersReality
ThreatFabric says the Android spyware encrypts stolen data and relays it over Wi-Fi Direct and Bluetooth when it cannot reach its C2, using up to four hops by default.
Perspective Coverage
4 publishersReality
Kaspersky says malware reached Android car head units through the vendor's own update mechanism, using a flag that installs apps the device never had. The payload has no interface at all.
Perspective Coverage
8 publishersReality
Zimperium's September 9 write-up describes an Indonesian-linked family that encrypts files and streams the screen at once, resolves its command server through a GitHub repository, and loses most of its encryption reach on Android 10.
Reality
Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.
Perspective Coverage
3 publishersReality
Zimperium says RatHat uses an accessibility grant to switch on Wireless Debugging and read its own 6-digit pairing code, leaving native daemons at shell privilege that keep answering after the app is removed.
Perspective Coverage
6 publishersReality
Have I Been Squatted found Corp MDM, a small Android implant that takes newly arriving SMS and switches on call forwarding, sharing one hard-coded address with the credential phishing and Windows malware aimed at the same sector.
Reality
The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.
Reality
Intel 471 found an unauthenticated panel called AppPanda running fake streaming lures behind paid Facebook ads, with affiliate tooling that re-signs the Android payload every hour and tracks ad spend the way a growth team would.
Reality
Malwarebytes traces fake Indeed "interview" APKs that impersonate the login page, open a VPN, and drop spyware once Accessibility Services is granted. Indeed says its interviews never need an app.
Reality