Threats Tagged 'maas'

Octagon is a newly identified Android malware-as-a-service bot discovered in June 2026, targeting cryptocurrency wallets, exchanges, and banking applications. It uses accessibility overlays, hidden VNC, SMS interception, unlock-pattern capture, and balance reading to steal credentials and control infected devices remotely. Distributed via sideloaded APKs bypassing restricted settings, Octagon connects devices to a Windows command-and-control panel for real-time monitoring and manipulation. The malware maintains persistence through multiple mechanisms and evades detection by appearing benign to security scans. It has been observed using lures such as the Lifted Dreams game and Bahrain government-themed bait. Octagon specifically targets apps like Trust Wallet, Binance, MEXC, MetaMask, Telegram, and WhatsApp to facilitate cryptocurrency theft and account takeover.

Insikt Group identified four new malware families from TAG-195 (Golden Chickens, Venom Spider), a financially motivated malware-as-a-service developer. The families include TinyEgg, a lightweight initial-access backdoor; ChonkyChicken, which expands capabilities with browser credential theft and session automation; a modularized ChonkyChicken variant using controller-and-plugin architecture; and ChromEggscalator, a modified Chrome encryption-bypass tool. TAG-127 has been observed deploying TinyEgg via ClickFix campaigns using fake security verification pages. The modular architecture reduces static detection exposure and enables selective capability provisioning to operators. All families share consistent architectural traits including WebSocket command-and-control, Run key persistence, string obfuscation, and execution via legitimate Windows binaries. This represents a deliberate architectural transition toward operator-driven tooling within the TAG-195 MaaS ecosystem.