MalwarePublished 3 Dec 2025

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets

Source AlienVault OTX General

Description

Albiriox is a newly discovered Android RAT malware offered as Malware-as-a-Service, primarily targeting financial and cryptocurrency applications globally. It uses a sophisticated two-stage deployment involving dropper apps and packing to evade detection. The malware enables remote control of infected devices via VNC-based access and overlay attacks, allowing real-time interaction and unauthorized operations such as screen manipulation and device takeover. It targets over 400 financial and crypto wallet apps, facilitating on-device fraud while remaining stealthy. The MaaS model and ongoing development indicate potential rapid spread among cybercriminals. Although no known exploits in the wild are reported yet, its advanced capabilities pose a significant threat to mobile users, especially in finance sectors. The malware is linked to Russian-speaking threat actors and uses multiple fake domains for distribution. European organizations with mobile banking and crypto wallet users are at risk, particularly in countries with high Android usage and financial sector prominence. Mitigation requires targeted detection of dropper apps, user education on app sources, and enhanced mobile endpoint protection. Given its impact on confidentiality, integrity, and availability with ease of exploitation and no user interaction needed post-installation, the threat severity is assessed as high.

Impact

For European organizations, Albiriox presents a substantial risk, especially to financial institutions, cryptocurrency exchanges, and users relying on mobile banking apps. The malware’s ability to remotely control devices and perform overlay attacks can lead to significant financial losses through fraudulent transactions and theft of cryptocurrency assets. Confidentiality is compromised as attackers can access sensitive credentials and personal data. Integrity is affected by unauthorized manipulation of device operations and transactions. Availability may be impacted if devices are rendered unstable or unusable due to malware activities. The stealthy nature of Albiriox complicates detection and response, increasing the window of opportunity for attackers. Given the widespread use of Android devices in Europe and the growing adoption of mobile financial services, the threat could disrupt trust in mobile platforms and cause reputational damage to affected organizations. The MaaS distribution model also implies a potential surge in infections, amplifying the threat landscape. Additionally, overlay attacks may trick users into divulging multi-factor authentication codes or other security tokens, further escalating risk. The threat is particularly concerning in countries with high smartphone penetration and active cryptocurrency markets.

Defensive guidance

European organizations should implement multi-layered defenses tailored to mobile environments. Specific recommendations include: 1) Deploy advanced mobile threat defense (MTD) solutions capable of detecting dropper apps, obfuscation, and overlay attack behaviors. 2) Enforce strict app installation policies restricting users to official app stores and block access to known malicious domains identified in the threat intelligence. 3) Conduct targeted user awareness training focusing on phishing, fake app stores, and social engineering tactics used to distribute Albiriox. 4) Implement behavioral analytics on mobile devices to detect anomalous remote control or screen manipulation activities indicative of RAT infections. 5) Employ mobile endpoint detection and response (EDR) tools with capabilities to quarantine or remove malicious apps promptly. 6) Encourage use of hardware-backed security features such as secure enclaves and biometric authentication to reduce credential theft risk. 7) Collaborate with mobile network providers to monitor and block suspicious command and control traffic patterns. 8) Regularly update mobile OS and security patches to reduce exploitation vectors. 9) Monitor threat intelligence feeds for indicators of compromise (IOCs) such as hashes and malicious domains associated with Albiriox to enable proactive detection. 10) For organizations with BYOD policies, enforce mobile device management (MDM) solutions to control app installations and enforce security configurations.

Summary

Albiriox is an advanced Android Remote Access Trojan (RAT) malware recently identified and offered as a Malware-as-a-Service (MaaS) platform, likely operated by Russian-speaking threat actors. It employs a two-stage infection chain starting with dropper applications that install the main RAT payload, utilizing packing and obfuscation techniques to evade detection by security solutions. The malware targets over 400 financial and cryptocurrency applications worldwide, focusing on stealing assets and credentials through sophisticated on-device fraud mechanisms. It leverages VNC-based remote access to enable attackers to control infected devices remotely, manipulate screens, and perform real-time interactions such as overlay attacks that deceive users into divulging sensitive information. The malware’s capabilities include device takeover, unauthorized operations, and stealthy persistence, making it difficult to detect and remediate. Distribution is facilitated through multiple fake domains mimicking legitimate Google app stores, increasing the likelihood of user infection via social engineering or phishing campaigns. The MaaS model allows rapid proliferation among cybercriminal groups, potentially increasing the scale and frequency of attacks. Although no confirmed exploits in the wild have been reported, the malware’s advanced features and targeting of critical financial and crypto applications pose a significant threat to mobile users and organizations relying on Android devices for financial transactions. The malware’s use of techniques mapped to MITRE ATT&CK tactics such as phishing (T1566), persistence (T1547), command execution (T1059), credential access (T1078), and user execution (T1204) underscores its sophistication and operational complexity.

Indicators of compromise

Domains 7

google-aplication.download
google-app-download.download
google-app-get.com
google-app-install.com
google-get-app.com
google-get.download
play.google-get.store

Hashes 12

61b59eb41c0ae7fc94f800812860b22a
b6bae028ce6b0eff784de1c5e766ee33
f09b82182a5935a27566cdb570ce668f
f5b501e3d766f3024eb532893acc8c6c
1bf53adfede11f6857a95d7b74b40011ff201009
731a13bad6316fda68c9d57fb4e562dd0c1130ce
b0913e8cbff6a9623cf97a3d4d796ec259e24df7
bb2b152adbba554409746bf64d8df71d80a236ea
070640095c935c245f960e4e2e3e93720dd57465c81fa9c72426ee008c627bf3
5e14181839816bbb4b55badc91f29d382e8d6f603eec2ed8f8b731c35def6b59

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Dec 2025, 11:35 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

Domains 7

Hashes 12

Community reviews

Related threats