Malicious Loan App Removed from iOS and Google Play App Store Posed Severe Risks to Users

A SpyLoan application called 'RapiPlata' was identified on a victim's device, having been downloaded by over 150,000 users from both Google Play and Apple App Store. The app, which ranked in the top 20 finance category in Colombia, had extensive access to sensitive user data, including SMS messages, call logs, calendar events, and installed applications. It uploaded this data to its servers, posing significant risks to users' privacy and financial security. The app's malicious behavior included harassing messages, unauthorized loan approvals, and data theft. Despite its removal from official app stores, it remains accessible through third-party websites. The app is part of a larger SpyLoan malware operation, with similarities to previously identified malicious apps.

• Inside a Global AI-Assisted Hacking CampaignMalware2026-10-22
• Disruption Targets Major Chinese-Language Phishing Kits with Japanese FocusCampaign2026-10-14
• XWorm Malware: Worming Its Way From Entry to ExploitationMalware2026-10-05
• Protecting organizations from AI-assisted executive impersonation and invoice fraudCampaign2026-09-10
• Apple Emergency iOS Security Update Patches Critical Zero-Click Exploit Actively Targeting US UsersAnalysis2026-07-14