Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated variant of the Android malware Konfety has been identified, employing advanced evasion techniques. The malware uses dual-app deception, ZIP-level evasion, dynamic code loading, and stealth techniques to conduct ad fraud and redirect users to malicious websites. It tampers with the APK's ZIP structure to bypass security checks and complicate reverse engineering. The malware loads encrypted assets at runtime, concealing critical functionality. It mimics legitimate apps, hides its icon, and uses geofencing to adjust behavior by region. The threat actors behind Konfety are highly adaptable, consistently updating their methods to evade detection and target various ad networks.

The Konfety malware is a sophisticated Android threat that has resurfaced with enhanced evasion capabilities designed to bypass detection and complicate analysis. This variant employs multiple advanced techniques including dual-app deception, where it masquerades as legitimate applications by hiding its icon and mimicking trusted apps to avoid user suspicion. It manipulates the APK's ZIP structure, a method known as ZIP-level evasion, to circumvent static security checks and hinder reverse engineering efforts. Additionally, Konfety uses dynamic code loading by decrypting and loading critical components at runtime, which conceals its true functionality from static scanners. The malware also implements geofencing to modify its behavior based on the user's geographic location, likely to evade detection in certain regions or to target specific markets. Its primary malicious activities include conducting ad fraud—generating fraudulent ad impressions and clicks to siphon revenue—and redirecting users to malicious websites, potentially exposing them to further threats. The malware leverages the CaramelAds SDK, indicating a focus on ad fraud infrastructure. The threat actors behind Konfety demonstrate high adaptability, frequently updating their tactics to evade detection and target diverse ad networks. While no known exploits in the wild have been reported, the complexity and stealth of this malware make it a persistent threat in the Android ecosystem.

MD5 of b8348f6a2b81216a7c4603c70dddcfbd95ed9a8a2119cb8547782ce115e85759

MD5 of 2d26502ff7a99c0df781ea7830fbafef621ff5c592a0803e63784f9b3d85d4ce

MD5 of eadcb8d177ef3fe5de6d0999d4f854485f79f832593c375491361b6a3e23d595

MD5 of 160a924a804c5f390358a17dcd45031a5785ae013990a9185d57a164d3836845

MD5 of ec7e1bb518d6d0a42afc78d33856e1b90a92f110a47cfd92ed9ff23a635ba017

MD5 of 30d8a0fc34697966f80ca9652e98781612006efc09df93f42b92c8f0d3979056

MD5 of 602972dfa5321381c4b40e35fe3f8b1ac66e7759c9c4a76efdffdbe0eaa1bca3

MD5 of 73763f6106f8c0e928fe302d5764926832cc3afabe016c35b9c9fd99656d5191

MD5 of 6dc9d8c1cf11138eccea44e3662b044879f9721c22d6e3a90a1fdb76e674260e

MD5 of 0bc62ee202ec3022da280dfec839e4dec0800bb421ed482a657abf7aaf6f9c10

MD5 of 6097ac05da6c79d06f8ced22edf611ad551fbad7a00410f14fa4831cc9ccf2ea

MD5 of 7f645f7794a3039ed57e68a2a4dccd9825de054cfa3aece8e58694183cfcdf7d

MD5 of 94c01ed008c8b83f1d9fc247b18ec36c05356b449a1d3d7940b0a737f3a61d22

MD5 of 6504fc4739d220dc98f3596a424479ce066ea5eed409f3bc2cf0ea08584e6dc1

MD5 of a8c6a7a08e836ffad32b706182aa081849688fbdc023841c36a0920d62dd1fd4

MD5 of 9f0778d5d3625321547d561e8c485f21ca606754e6c107685b97b3800336f3ee

MD5 of 8449156b632a3d7839c632377197728430e4dea8c7fa9a02648d13f9fa33bb8b

MD5 of d554ec3737d2ce09ab44366b210a0a3ce73af687b0a55047d899913c5932a14c

MD5 of 45ccf69ad2b86b46d749998438aa090c50f0e3b12b74d109c02e3de70152f2ab

MD5 of 3b6cdd4d708c3c79c7c2adbb2394293797a2c9cace8f724a14ed1dfa49d4a025

SHA1 of 7f645f7794a3039ed57e68a2a4dccd9825de054cfa3aece8e58694183cfcdf7d

SHA1 of 6097ac05da6c79d06f8ced22edf611ad551fbad7a00410f14fa4831cc9ccf2ea

SHA1 of 94c01ed008c8b83f1d9fc247b18ec36c05356b449a1d3d7940b0a737f3a61d22

SHA1 of d554ec3737d2ce09ab44366b210a0a3ce73af687b0a55047d899913c5932a14c

SHA1 of 30d8a0fc34697966f80ca9652e98781612006efc09df93f42b92c8f0d3979056

SHA1 of 0bc62ee202ec3022da280dfec839e4dec0800bb421ed482a657abf7aaf6f9c10

SHA1 of 160a924a804c5f390358a17dcd45031a5785ae013990a9185d57a164d3836845

SHA1 of 6504fc4739d220dc98f3596a424479ce066ea5eed409f3bc2cf0ea08584e6dc1

SHA1 of 45ccf69ad2b86b46d749998438aa090c50f0e3b12b74d109c02e3de70152f2ab

SHA1 of a8c6a7a08e836ffad32b706182aa081849688fbdc023841c36a0920d62dd1fd4

SHA1 of ec7e1bb518d6d0a42afc78d33856e1b90a92f110a47cfd92ed9ff23a635ba017

SHA1 of 9f0778d5d3625321547d561e8c485f21ca606754e6c107685b97b3800336f3ee

SHA1 of 8449156b632a3d7839c632377197728430e4dea8c7fa9a02648d13f9fa33bb8b

SHA1 of b8348f6a2b81216a7c4603c70dddcfbd95ed9a8a2119cb8547782ce115e85759

SHA1 of 73763f6106f8c0e928fe302d5764926832cc3afabe016c35b9c9fd99656d5191

SHA1 of 6dc9d8c1cf11138eccea44e3662b044879f9721c22d6e3a90a1fdb76e674260e

SHA1 of eadcb8d177ef3fe5de6d0999d4f854485f79f832593c375491361b6a3e23d595

SHA1 of 3b6cdd4d708c3c79c7c2adbb2394293797a2c9cace8f724a14ed1dfa49d4a025

SHA1 of 602972dfa5321381c4b40e35fe3f8b1ac66e7759c9c4a76efdffdbe0eaa1bca3

SHA1 of 2d26502ff7a99c0df781ea7830fbafef621ff5c592a0803e63784f9b3d85d4ce

Detailed information about Konfety Returns: Classic Mobile Threat with New Evasion Techniques. Get real-time updates, technical details, and mitigation strategi

Title	Severity	Type	Source	Date

Threats Tagged 'ad fraud infrastructure'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'ad fraud infrastructure'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility