Hirudo, an Android trojan, swaps eight Indonesian banking apps for patched copies that blind their own integrity checks, ThreatFabric says. The victim must approve the swap, and afterwards the app's checks answer as the operator scripts them.
Perspective Coverage
5 publishers
- Builder
- Builder 27%
- Operator
- Operator 51%
- Investor
- Investor 22%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence70
GhostBat RAT now watches 60 Indian finance apps for PINs, Cyble reports
Cyble says GhostBat RAT, spread by fake mParivahan and eChallan traffic-fine texts, now monitors 60 Indian banking, UPI and wallet apps for PINs. Its invisible-keypad overlay targets only Google Pay and MobiKwik.
Reality
- Evidence50
- Adoption20
- Hype gap+10
- Incentives40
- Confidence55
Bitdefender found ad-fraud malware preinstalled in the firmware of thousands of cheap MediaTek-based Android phones in more than 150 countries. The implant cannot be uninstalled, so the point of purchase is where a buyer can keep it out.
Perspective Coverage
9 publishers
- Builder
- Builder 22%
- Operator
- Operator 57%
- Investor
- Investor 21%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence70
buildOne report1 publisher Messenger Pro built its real payload in four stages after it cleared Google Play review
CERT Polska found that Messenger Pro cleared Google Play review as a 40MB base APK whose malicious loader was 0.552% of its code. Its real payload never shipped to the store; stage two pulled it from an Alibaba Cloud bucket only after install.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence58
Ukraine's cyber agency ties DarkSword iPhone attacks to hacked news and government sites
Ukraine's SSSCIP says Russian hackers are going after military and government phones, using hacked news and government sites to push the DarkSword iPhone kit. Because the kit needs little or no action from the victim, the defense falls on the phone's own software and how current it is.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence55
Group-IB says a 13-minute call ended with a loan in the victim's name and card data streaming to a fake merchant terminal, every transaction approved with the victim's own PIN.
Perspective Coverage
3 publishers
- Builder
- Builder 27%
- Operator
- Operator 63%
- Investor
- Investor 10%
Reality
- Evidence62
- Adoption20
- Hype gap+10
- Incentives40
- Confidence65
ThreatFabric says the Android spyware encrypts stolen data and relays it over Wi-Fi Direct and Bluetooth when it cannot reach its C2, using up to four hops by default.
Perspective Coverage
4 publishers
- Builder
- Builder 36%
- Operator
- Operator 58%
- Investor
- Investor 6%
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence68
Kaspersky says malware reached Android car head units through the vendor's own update mechanism, using a flag that installs apps the device never had. The payload has no interface at all.
Perspective Coverage
8 publishers
- Builder
- Builder 36%
- Operator
- Operator 50%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence68
Zimperium's September 9 write-up describes an Indonesian-linked family that encrypts files and streams the screen at once, resolves its command server through a GitHub repository, and loses most of its encryption reach on Android 10.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives30
- Confidence65
Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 67%
- Investor
- Investor 10%
Reality
- Evidence55
- Adoption30
- Hype gap+15
- Incentives50
- Confidence60
Zimperium says RatHat uses an accessibility grant to switch on Wireless Debugging and read its own 6-digit pairing code, leaving native daemons at shell privilege that keep answering after the app is removed.
Perspective Coverage
6 publishers
- Builder
- Builder 32%
- Operator
- Operator 63%
- Investor
- Investor 5%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+25
- Incentives55
- Confidence66
Have I Been Squatted found Corp MDM, a small Android implant that takes newly arriving SMS and switches on call forwarding, sharing one hard-coded address with the credential phishing and Windows malware aimed at the same sector.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence66
buildOne report1 publisher Gigabud clones a banking app into an Android work profile to register a new device
The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.
Reality
- Evidence42
- Adoption38
- Hype gap+12
- Incentives34
- Confidence48
Meta ads drove nearly 15,000 PanDa RAT installs in Mexico in one week
Intel 471 found an unauthenticated panel called AppPanda running fake streaming lures behind paid Facebook ads, with affiliate tooling that re-signs the Android payload every hour and tracks ad spend the way a growth team would.
Reality
- Evidence64
- Adoption74
- Hype gap+15
- Incentives58
- Confidence56
The fake Indeed interview app that stops you uninstalling it
Malwarebytes traces fake Indeed "interview" APKs that impersonate the login page, open a VPN, and drop spyware once Accessibility Services is granted. Indeed says its interviews never need an app.
Reality
- Evidence54
- Adoption22
- Hype gap+18
- Incentives66
- Confidence56