Threats Tagged 'firebase c2'

A sophisticated mobile threat linked to Indonesian actors combines ransomware and spyware capabilities in a single attack vector. The malware is distributed via third-party file-sharing platforms through social engineering, targeting Android devices. It requests extensive permissions including device administrator, SMS, contacts, and accessibility access. The threat encrypts files using AES on Android 9 and earlier, appending .enc extensions, while stealing sensitive data including screen recordings, browser history, PINs, contacts, call logs, SMS messages, WhatsApp and Telegram chats. It establishes C2 communication via HTTPS and WebSockets using dynamic domain resolution through GitHub. Version 2 introduces UI hijacking, screen blocking, touch input interception, harassment features, and remote text-to-speech capabilities. The malware exfiltrates data through Firebase and Catbox services, enabling double-extortion through an interactive chat portal for ransom demands.

MediumMalwareIndonesia#toxicpanda#android#firebase c2

An Android malware campaign masquerading as a bank KYC verification application targets users in India through WhatsApp distribution. The threat operates as a multi-stage dropper installing secondary payloads while establishing persistent command-and-control communication. It combines native code obfuscation, Firebase-based remote execution, VPN-based traffic manipulation, and WebView-based phishing to systematically harvest sensitive user data. The infection chain progresses through deceptive update screens, VPN activation, silent APK installation, and extensive permission abuse. The deployed payload enables SMS interception, call control, USSD execution, and structured credential theft through staged phishing interfaces mimicking legitimate banking workflows. Exfiltrated data is encrypted locally and transmitted to jsonapi.biz, while critical configuration values are hidden inside native libraries to hinder detection.

MediumMalwareIndia#india targeting#android banking trojan#otp theft