Octagon is an Android fraud bot sold as malware-as-a-service by the Russian-speaking actor AndroidKitKat for $1,400 monthly. It employs accessibility overlays to capture user input, hidden VNC for remote device control, SMS interception, unlock-pattern capture, and balance reading to target cryptocurrency wallets, exchanges, and banking apps. The malware is distributed through sideloaded APKs that bypass Android's Restricted Settings protections. Once installed, it connects infected devices to a Windows-based command-and-control panel where operators monitor applications, read device screens, and control devices remotely. Persistence is maintained through various mechanisms, and the malware is designed to appear benign to security scans. Three APK samples have been recovered, including those using the Lifted Dreams game and Bahrain government-themed lures. Credential theft is facilitated via HTML WebView overlays targeting Trust Wallet, Binance, MEXC, MetaMask, and messaging apps like Telegram and WhatsApp, enabling cryptocurrency theft and account takeover.

Octagon enables attackers to remotely control infected Android devices, intercept SMS messages, capture unlock patterns, and steal credentials from targeted cryptocurrency wallets, exchanges, and banking applications. This can lead to unauthorized access to financial accounts, theft of cryptocurrency assets, and compromise of messaging apps. The malware's persistence and stealth capabilities increase the risk of prolonged undetected compromise on infected devices.

No official patch or remediation is currently available as this is malware distributed via sideloaded APKs. Users should avoid installing applications from untrusted sources and sideloaded APKs. Security teams should monitor for indicators of compromise such as the provided IP addresses, hashes, and URLs associated with Octagon. Employ mobile threat defense solutions capable of detecting accessibility abuse and overlay attacks. Users should be cautious of phishing lures mimicking legitimate games or government sites. Regularly updating devices and apps, and using multi-factor authentication on financial and messaging apps can reduce risk. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.