tag: Android-Malware · 14 items
- Engineer — Learn: Novel technique of substituting legitimate banking apps with trojanized patched variants that bypass internal integrity checks is relevant to mobile app security design; no cloud/infra exposure and no KEV or PoC to force immediate action.
- SOC/IR — Learn: The app-replacement TTP is a meaningful escalation in mobile banking fraud, but no IOCs, ATT&CK mappings, or enterprise-estate detection surface were published; file away for context if mobile MDM telemetry is in scope.
- Leader — Skip
- Engineer — Learn: Hirudo’s technique of swapping patched banking APKs to bypass integrity checks is a novel supply-chain-adjacent pattern worth understanding when evaluating mobile app security controls and app attestation designs.
- SOC/IR — Plan: Build or tune detections for unauthorized APK replacement behavior on enrolled Android devices; review MDM/EMM telemetry for sideloaded or tampered banking apps in the managed estate.
- Leader — Learn: Awareness item for mobile banking risk posture; no immediate vendor exposure or regulatory trigger, but useful context if the organization offers a mobile banking app or mandates banking apps on corporate devices.
- Engineer — Skip
- SOC/IR — Learn: RatHat is an Android banking trojan MaaS with ~100 console deployments since April 2026; no IOCs or ATT&CK mappings are provided, but the AI-assisted victim prioritization technique is worth tracking as a detection research topic for mobile threat programs.
- Leader — Learn: The AI-augmented victim triage capability in this MaaS model signals an escalating threat to retail banking and mobile-first enterprises; useful context for next board or risk-committee discussion on AI-enabled fraud trends.
- Engineer — Skip
- SOC/IR — Learn: New Android MaaS platform using TVTap IPTV impersonation as a lure; worth tracking if your org manages mobile devices or BYOD — monitor for the campaign pattern if IOCs emerge.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: No IOCs or mapped TTPs are available yet, so there is nothing actionable to hunt or detect today, but the AI-assisted navigation capability is a novel operator-aid technique worth tracking as similar features may appear in future mobile threat tooling.
- Leader — Learn: AI-augmented malware lowering the skill floor for remote device control is an emerging trend worth noting in mobile risk discussions, though no enterprise-targeted campaign or signals are reported here.
- Engineer — Learn: The ADB-based persistence mechanism — retaining shell access after the app is removed — is a novel technique worth understanding for Android MDM/BYOD posture reviews, but there are no enrichment signals and no cloud/infra surface to patch today.
- SOC/IR — Learn: No IOCs or ATT&CK-mapped detections are provided, so there is nothing to hunt immediately; the smishing delivery chain and ADB persistence behavior are worth filing for future Android/BYOD detection coverage if your estate includes managed Android endpoints.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: A new Android malware family blending ransomware encryption with data-exfiltration and harassment is worth cataloguing, but no IOCs, TTPs, or detection content are provided, so no hunt or rule-writing is actionable yet.
- Leader — Skip
- Engineer — Learn: Relevant if your organization develops or distributes Android banking apps; the work-profile sandboxing abuse is a novel evasion technique worth factoring into mobile app integrity checks and attestation logic.
- SOC/IR — Learn: No IOCs or ATT&CK mappings are surfaced in this item, but the work-profile evasion mechanism is useful context for analysts triaging mobile endpoint alerts or evaluating MDM telemetry gaps.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: StreamRat demonstrates a malvertising delivery chain for Android banking trojans capable of near-complete device takeover; worth noting the ad-platform distribution vector for mobile threat modeling, though no IOCs or ATT&CK mappings are available to act on today.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: The VPN-permission-as-blocker technique is a noteworthy evasion TTP for mobile threat awareness, but the summary provides no IOCs or detection signatures to act on; file for context when tuning mobile EDR or MAM policies.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: The updater-as-delivery-channel technique on Android-based embedded devices is a noteworthy TTP, and the proxy botnet component could eventually surface in network telemetry — but no IOCs or ATT&CK mappings are provided, leaving no concrete detection action available today.
- Leader — Skip
- Engineer — Learn: No infrastructure or cloud exposure here; this is a mobile banking trojan. Worth understanding the PIN-harvesting technique if your org develops mobile banking apps, but no patch or configuration action required.
- SOC/IR — Plan: No IOCs published in this item, but the expanded 140+ targeted app list and new remote-command capability warrant building or tuning mobile threat detections; review Zimperium’s full report for indicators to add to mobile MDM alerting.
- Leader — Learn: Relevant if your org operates a banking or crypto app; file as emerging mobile fraud risk for the next risk-register review, but no immediate board-level action indicated without corroborating incident data.
- Engineer — Skip
- SOC/IR — Learn: The P2P relay exfiltration method — routing data through nearby compromised devices — is a novel evasion technique worth understanding, but no IOCs or enterprise-targeting details are published yet to build detections against.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: WindRelay/SpyNote combo represents a maturing NFC relay technique worth tracking for mobile threat awareness, but no enterprise detection surface or IOCs are provided to act on.
- Leader — Skip