Threats Tagged 'android rat'

Hagaseca is an Android malware cluster linked to exposed Android Debug Bridge (ADB) services, focusing on the THost9 RAT loader variant. The malware conceals executable code within an APK that loads tc9.dex, a stage providing shell access, file transfer, and ADB propagation capabilities. Public incidents connect THost4 and THost9 to exposed Android and Redroid systems from October 2024 through 2026. The loader uses XOR and gzip packing, establishes persistence through foreground services, exploits accessibility features for device control, and downloads additional stages from test.hagaseca.com. The tc9.dex stage implements remote administration, discovers ADB endpoints via mDNS, scans entire /16 networks, authenticates with prepared keys, and installs itself on vulnerable systems. The malware exhibits worm-like behavior, spreading opportunistically through unsecured ADB services exposed to the internet, particularly affecting Redroid container deployments and devices with public ADB over Wi-Fi.

Balonx Sistema is a sophisticated Phishing-as-a-Service (PhaaS) platform originating from Mexico that targets over 20 financial institutions. It uses real-time WebSocket session hijacking to bypass multi-factor authentication and distributes a Spyroid-based Android Remote Access Trojan (RAT) via fake security alerts. Since October 2025, it has harvested credentials from more than 1,100 victims. The platform includes CallFlow, an AI-driven vishing module leveraging GPT-4o-mini, ElevenLabs synthetic voice, and OpenAI Whisper to automate telephone fraud without human operators. It employs continuous domain rotation across more than 350 domains since 2019 and maintains centralized PostgreSQL infrastructure. The service is openly promoted on Facebook groups and generates approximately $99,000 USD weekly through subscription fees. Indicators such as IP 196.251.84.11 and multiple domains are associated with this threat. The platform primarily targets Mexican financial institutions.

MediumMalwareMexico#websocket hijacking#cryptocurrency payments#spyroid

Researchers uncovered a fractured criminal ecosystem built around Flying Eagle, an Android remote access tool whose source code was stolen in early 2026 along with nearly 200 customer databases. The investigation began with a malicious APK impersonating a Chinese Provincial Public Security Bureau app, leading to identification of 170 active servers running the framework. Two Telegram channels, SQLRCE0 and Yx Technology, distribute modified versions with operational support and cash-out services at 20-50% transaction fees. The platform combines APK generation and C2 device management with phishing overlays targeting financial, adult, and government services. A successor platform called Night Dragon was introduced in June 2026, featuring enhanced credential capture capabilities for Chinese banking apps, cryptocurrency wallets, and social media platforms. The activity primarily targets Chinese citizens through social engineering lures, though international templates suggest broader targeting capability.

MediumMalwareChinaThailand#mobile banking fraud#spynote#telegram distribution

RedHook is an Android Remote Access Trojan that has re-emerged with significant enhancements, particularly in privilege abuse capabilities. The malware autonomously exploits Android's ADB Wireless Debugging features to obtain shell-level access, integrating the Shizuku framework to execute protected system APIs. Recent activity shows expansion beyond Vietnam to Indonesia, targeting Southeast Asian users through spoofed government and financial websites. Malicious APKs are hosted on trusted platforms like AWS S3 and GitHub repositories. The current version supports 53 distinct server-issued commands and employs sophisticated persistence mechanisms including foreground activity spoofing, silent media playback, and cross-process monitoring. Distribution relies on social engineering via phone calls and messaging applications, tricking victims into downloading malicious APKs and enabling Accessibility services under false pretenses.

MediumMalwareIndonesia#adb wireless debugging#phishing#persistence mechanisms

BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach.

MediumMalwareArgentinaBrazil#android rat#latin america#phishing campaigns