This SecurityWeek roundup highlights multiple cybersecurity issues including new Android spyware targeting UAE users, a data breach at FEMA via Citrix exploitation, and vulnerabilities in Tile trackers. The Android spyware, disguised as legitimate apps, requires manual installation and exfiltrates sensitive data. The FEMA breach involved exploitation of a Citrix vulnerability dubbed CitrixBleed 2, leading to employee data theft and organizational repercussions. Tile tracker vulnerabilities allow unauthorized location tracking and compromise anti-theft features. Additional concerns include phishing campaigns abusing industrial routers and evolving post-quantum cryptography adoption. While no single exploit is widespread, these combined threats pose medium-level risks, especially to organizations with exposed infrastructure or users in affected regions. European entities should be vigilant about supply chain and endpoint security, particularly regarding mobile devices and IoT trackers. Mitigations include strict app installation policies, patching Citrix products, network segmentation, and enhanced monitoring of IoT devices. Countries with significant Citrix deployments, industrial infrastructure, and mobile user bases, such as Germany, the UK, France, Belgium, and the UAE-linked diaspora, are most likely affected.
Two Android spyware campaigns, ProSpy and ToSpy, have been discovered targeting users in the United Arab Emirates. These campaigns impersonate secure messaging apps like Signal and ToTok, distributing malware through deceptive websites and social engineering tactics. Once installed, the spyware exfiltrates sensitive data including contacts, SMS messages, files, and device information. The campaigns use persistence mechanisms to ensure continuous operation on compromised devices. ProSpy disguises itself as encryption plugins or pro versions of apps, while ToSpy exclusively mimics the ToTok app. The malware is distributed through unofficial sources, highlighting the risks of downloading apps outside official app stores.
A new Android banking trojan named RatOn has emerged, combining NFC relay attacks with remote access and automated transfer capabilities. Discovered by analysts monitoring the NFSkate threat group, RatOn targets cryptocurrency wallets and banking applications, particularly in the Czech Republic and Slovakia. The malware is distributed through adult-themed websites and employs a multi-stage infection process. RatOn features overlay attacks, automated money transfers, and cryptocurrency wallet takeovers. It demonstrates sophisticated capabilities, including screen casting, PIN interception, and extensive bot commands. The trojan's evolution from a basic NFC relay tool to a complex RAT with ATS functionality makes it a significant threat in the mobile malware landscape.
This analysis reveals the resurgence of SpyNote, a potent Android RAT, distributed through deceptive websites mimicking Google Play Store. The malware employs sophisticated techniques for surveillance, data exfiltration, and remote control. Recent changes include minor IP resolution adjustments and enhanced anti-analysis measures in the APK dropper. SpyNote's capabilities include keylogging, camera and microphone control, and abuse of Android's Accessibility Services. The threat actor demonstrates persistence and limited technical adaptability, targeting consumers broadly with lures mimicking popular applications. Key technique changes involve dynamic payload decryption, DEX element injection, and obfuscation of C2 logic. The campaign underscores the ongoing threat of mobile RATs and the need for vigilance against social engineering tactics.
A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging apps and browsers, and keylogging. Distributed via messenger apps, it requests numerous system permissions and connects to C2 servers for commands. The backdoor can transmit SMS messages, contact lists, call logs, location data, and captured audio/video streams. It uses Accessibility Service to log keystrokes and intercept content from specific apps like Telegram and Chrome. The malware is believed to be used for targeted attacks rather than mass distribution.
Anatsa, an Android banking malware first discovered in 2020, has evolved with new capabilities and targets. The latest variant now affects over 831 financial institutions worldwide, including new countries and cryptocurrency platforms. Anatsa has streamlined its payload delivery, implemented DES runtime decryption, and added device-specific restrictions. The malware uses decoy applications in the Google Play Store, some exceeding 50,000 downloads. Alongside Anatsa, 77 other malicious apps from various families were identified, totaling over 19 million installs. Anatsa's evasion techniques include emulation checks, device model verification, and the use of malformed archives to hide malicious code. The malware primarily steals credentials through fake banking login pages tailored to detected financial apps on the user's device.
MuddyWater, an Iranian cyber espionage group, is deploying DCHSpy, an Android surveillance malware, amid the Israel-Iran conflict. DCHSpy is distributed through malicious VPN apps promoted on Telegram and can collect extensive data including WhatsApp messages, contacts, SMS, files, location, call logs, audio recordings, and photos. Recent variants have improved data exfiltration capabilities, particularly targeting WhatsApp and specific files. The malware uses lures related to StarLink to exploit internet outages in Iran. It shares infrastructure with SandStrike, another Android malware targeting Bahá’í practitioners. This campaign poses significant espionage risks to Android users in targeted regions and conflict zones.
A large-scale Malware-as-a-Service operation, orchestrated by Chinese-speaking threat actors, has infected over 11,000 Android devices globally with the PlayPraetor Remote Access Trojan. The campaign primarily targets Europe, with significant presence in Portugal, Spain, and France, but also affects Africa, Latin America, and Asia. The botnet is expanding rapidly, with over 2,000 new infections weekly, focusing on Spanish and French speakers. The operation is managed through a sophisticated Chinese-language Command and Control panel, supporting multiple affiliates. PlayPraetor abuses Android's Accessibility Services to gain real-time control over compromised devices, targeting nearly 200 banking apps and cryptocurrency wallets worldwide.
A sophisticated mobile banking trojan, DoubleTrouble, has evolved in distribution methods and capabilities. Initially spread through phishing websites impersonating European banks, it now utilizes Discord channels for distribution. The malware employs advanced obfuscation techniques, abuses Android's Accessibility Services, and features screen capture, keylogging, and application blocking capabilities. It uses fake overlays to steal credentials and leverages sophisticated screen recording techniques. The trojan can block specific applications, implement a highly advanced keylogger, and execute a wide range of commands received from its Command and Control server. The malware's extensive functionalities enable credential theft, device manipulation, and persistent control over infected devices.
A sophisticated Android banking trojan named RedHook has been discovered targeting Vietnamese users through spoofed government and financial websites. The malware uses WebSocket to communicate with its command-and-control server and supports over 30 remote commands, enabling complete control over compromised devices. RedHook combines phishing, RAT, and keylogging capabilities to exfiltrate credentials and conduct fraud. It abuses Android's MediaProjection API for screen capture and sends data to a live C2 server. The malware's low antivirus detection rate makes it a stealthy and active threat. Code artifacts suggest development by a Chinese-speaking threat actor or group. An exposed AWS S3 bucket revealed operational data dating back to November 2024, indicating a shift from previous scam campaigns to this advanced banking trojan.
This report analyzes a sophisticated Android malware targeting Indian banking apps. The malware uses a dropper and main payload structure, leveraging permissions like SMS access and silent installation to steal credentials, intercept messages, and perform unauthorized financial activities. It employs Firebase for command and control, phishing pages to mimic banking interfaces, and techniques like call forwarding abuse. The malware's modular architecture, evasion tactics, and persistence mechanisms pose significant threats to mobile banking security. Distribution methods include smishing, fake websites, and malvertising. The report provides detailed static and dynamic analysis, highlighting the malware's capabilities in data exfiltration, debit card harvesting, and remote command execution.
A new Android malware campaign has been discovered, disguising itself as a banking app to covertly mine cryptocurrency on locked devices. The malware, distributed through a phishing website impersonating Axis Bank, downloads and executes a modified version of XMRig, a popular cryptocurrency mining software. It monitors the device's lock state and battery level, initiating mining operations when the device is locked and stopping when unlocked. This stealthy approach allows for persistent mining, leading to excessive heat generation, battery drain, and potential hardware damage. The malware uses multiple hosting platforms to distribute its payload and connects to specific mining pools. Its impact on devices includes high CPU and memory usage, significant temperature increases, and overall performance degradation.
A sophisticated variant of the Android malware Konfety has been identified, employing advanced evasion techniques. The malware uses dual-app deception, ZIP-level evasion, dynamic code loading, and stealth techniques to conduct ad fraud and redirect users to malicious websites. It tampers with the APK's ZIP structure to bypass security checks and complicate reverse engineering. The malware loads encrypted assets at runtime, concealing critical functionality. It mimics legitimate apps, hides its icon, and uses geofencing to adjust behavior by region. The threat actors behind Konfety are highly adaptable, consistently updating their methods to evade detection and target various ad networks.
A new spyware campaign dubbed SparkKitty has been discovered targeting both iOS and Android devices. The malware, believed to be connected to the previously identified SparkCat campaign, is distributed through official app stores and unofficial sources. It primarily steals photos from infected devices, likely searching for cryptocurrency wallet information. The campaign has been active since at least February 2024 and mainly targets users in Southeast Asia and China. The malware is embedded in various apps, including modified versions of popular applications like TikTok, and uses different techniques to evade detection. The researchers identified multiple variations of the malware, including obfuscated libraries and malicious frameworks mimicking legitimate ones.
Multiple samples of SpyNote, a sophisticated Android spyware, were discovered in open directories, disguised as legitimate apps like Google Translate, Temp Mail, and Deutsche Postbank. The malware exploits accessibility services and device administrator privileges to steal sensitive information from infected devices. Samples were found on various servers, including AWS and SonderCloud Limited, with different command and control (C2) infrastructures. The discovery highlights the ongoing threat of SpyNote, especially after its source code leak in late 2022, and emphasizes the importance of proactive threat detection and analysis.
An investigation uncovered more than 20 cryptocurrency phishing applications on the Google Play Store impersonating legitimate wallets like SushiSwap and PancakeSwap. These malicious apps employ phishing techniques to steal users' mnemonic phrases, allowing access to real wallets and theft of funds. The apps share common patterns, including embedded C&C URLs in privacy policies and similar package names. They are distributed through compromised developer accounts previously used for legitimate apps. Two main types were identified: those using the Median framework and those directly loading phishing URLs into WebViews. The campaign demonstrates a coordinated operation with a large-scale phishing infrastructure linked to over 50 domains.
HUMAN's Satori team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting over 1 million low-cost consumer devices worldwide. The scheme involves a backdoor pre-installed on devices or distributed through unofficial app marketplaces, allowing threat actors to conduct various fraudulent activities. These include selling residential proxy services, ad fraud through hidden ads and WebViews, and click fraud. Four main threat actor groups were identified: SalesTracker, MoYu, Lemon, and LongTV. The operation affects Android Open Source Project devices in 222 countries, with Brazil being the most impacted. Disruption efforts involved collaboration with Google and other partners to mitigate the threat's impact.
A new Android banking Trojan, Crocodilus, has rapidly evolved since its discovery in March 2025. Initially targeting Turkey, it has expanded to European countries and South America. The malware is distributed through malicious advertising on social networks, masquerading as banking and e-commerce apps. Recent developments include improved obfuscation techniques, the ability to add contacts to the victim's device, and an enhanced seed phrase collector for cryptocurrency wallets. Campaigns have been observed targeting users in Poland, Spain, and multiple global locations. The malware's sophistication and expanding reach indicate a well-organized threat actor, posing an increasing risk to users and organizations worldwide.
APT36, also known as Transparent Tribe, has been observed using VPS provider Contabo to host malicious infrastructure for CapraRAT and Crimson RAT. Their latest tactic involves disguising spyware as the popular messaging app Viber, granting extensive permissions to record calls, read messages, and track location. The investigation traced the infrastructure, identified key Indicators of Compromise, and uncovered the full extent of this Android surveillance campaign. The threat actor employs social engineering tactics to distribute their Android Remote Access Trojans, with lures crafted to align with the RAT's disguise. The malware's capabilities include targeted surveillance, credential theft, and infrastructure abuse, potentially eroding brand trust in legitimate communication platforms.
