MalwarePublished 19 Nov 2025Updated 19 Dec 2025

GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices

Source AlienVault OTX General

Description

A sophisticated Android dropper impersonating the Google Play Store was discovered, distributing an app called 'GPT Trade'. This malicious application, disguised as an AI trading assistant, actually deploys two dangerous payloads: BTMob spyware and UASecurity Miner. The dropper creates directories, unpacks components, and generates new APK files before silently installing the malware. BTMob grants extensive device access, enabling credential theft and surveillance. UASecurity Miner focuses on persistence and remote control. The attack chain involves social engineering, APK generation, third-party packer services, and multiple command and control endpoints, reflecting a growing trend in modular Android threats.

Impact

For European organizations, the GPT Trade malware poses several risks. The spyware component (BTMob) can lead to credential theft, compromising user accounts and potentially granting attackers access to corporate networks and sensitive data. Surveillance capabilities threaten privacy and may lead to industrial espionage or data leakage. The cryptocurrency mining payload (UASecurity Miner) can degrade device performance, increase operational costs, and reduce device lifespan, impacting productivity. The stealthy installation and modular design complicate detection and remediation, increasing the risk of prolonged undetected presence. Organizations relying on Android devices for business operations, especially in finance, trading, and critical infrastructure, face heightened risks. Additionally, the use of fake app stores undermines trust in mobile ecosystems and can lead to broader supply chain security concerns. The social engineering aspect increases the likelihood of successful infection, particularly among less security-aware users. Overall, this threat can disrupt business continuity, lead to financial losses, and damage organizational reputation.

Defensive guidance

European organizations should implement a multi-layered defense strategy against GPT Trade malware. First, enforce strict policies to prevent installation of apps from unofficial or third-party app stores, leveraging Mobile Device Management (MDM) solutions to whitelist approved applications. Educate users about the risks of social engineering and the dangers of installing apps from untrusted sources, emphasizing verification of app authenticity. Deploy advanced mobile threat detection and response tools capable of identifying APK packer usage, suspicious directory creation, and unusual network communications to known C2 domains and IPs. Regularly update Android OS and security patches to reduce exploitation windows. Monitor network traffic for connections to the identified malicious IP addresses and domains, and block them at the firewall or proxy level. Conduct periodic audits of installed applications on corporate devices to detect unauthorized apps. Implement strong authentication mechanisms and credential protection to mitigate the impact of potential credential theft. Finally, collaborate with threat intelligence providers to stay informed about emerging indicators of compromise and evolving tactics related to this malware family.

Indicators of compromise

Domains 2

playgoogle-gpttrade.com
aptabase.fud2026.xyz

URLs 3

http://95.164.53.100/private/yarsap_80541.php
https://aptabase.fud2026.xyz:8443/api/v0/event
https://playgoogle-gpttrade.com/GPT%20Trade.apk

IP addresses 2

207.90.195.25
95.164.53.100

Hashes 6

25e3c200de4868d754a3b4f4f09ec2bf
4ccb99a365b4a42e8b565f8058d059bc
526e3f4426359b4b31f3d746acfb4d13
0a542751724a432a8448324613e0ce10393e41739a1800cbb7d5a2c648fcdc35
7f005c10f80372311e9c038526d81d931672d15c644fef2a77eefd67c6235917
918f002a41f9551d48ece999ccba504fcf7596017d9566c07c5335fe0081effe

Community reviews

Loading reviews…