Konfety Returns: Classic Mobile Threat with New Evasion Techniques

A sophisticated variant of the Android malware Konfety has been identified, employing advanced evasion techniques. The malware uses dual-app deception, ZIP-level evasion, dynamic code loading, and stealth techniques to conduct ad fraud and redirect users to malicious websites. It tampers with the APK's ZIP structure to bypass security checks and complicate reverse engineering. The malware loads encrypted assets at runtime, concealing critical functionality. It mimics legitimate apps, hides its icon, and uses geofencing to adjust behavior by region. The threat actors behind Konfety are highly adaptable, consistently updating their methods to evade detection and target various ad networks.

• Multiple Lenovo Tablets shipped with a known private test key for Android Verified BootHighVulnerability2026-10-20
• YuanKong RAT: the Android remote-control service that stamps its operators' names into every buildMalware2026-10-16
• Android gets AI defenses against messaging scams, fake callsNews2026-10-15
• Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized CopiesMalware2026-10-15
• VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation LogicMediumVulnerability2026-10-14