Threats Tagged 'mobile malware'

A new campaign by Kimsuky involves distributing malicious mobile apps through QR codes and phishing websites. The apps, masquerading as delivery services, VPNs, and cryptocurrency tools, decrypt an embedded APK to deploy a RAT with extensive capabilities. The malware uses a native decryption function and diverse decoy behaviors. Infrastructure overlaps and Korean language comments link this activity to Kimsuky. The threat actor employs sophisticated phishing techniques and leverages QR codes to redirect victims to malicious downloads. The malware requests extensive permissions and implements keylogging, audio recording, and data exfiltration. Multiple C&C servers were identified, some hosting Naver and Kakao phishing sites.

MediumMalwareGermanyFranceUnited Kingdom+4#mobile malware#qr code#rat

A sophisticated mobile malware campaign is targeting Indonesian pensioners by impersonating TASPEN, the state pension fund. The attackers use a phishing website to distribute a malicious Android app that steals banking credentials, intercepts SMS messages for OTPs, and captures biometric data. The malware employs advanced evasion techniques and communicates with a command and control server, likely operated by a Chinese-speaking threat actor. This campaign poses significant risks to Indonesia's digital transformation efforts and public trust in government institutions. The successful targeting of TASPEN creates a dangerous precedent for attacks on other critical financial entities across Southeast Asia.