android malware7 articles
Hirudo Android Trojan Swaps Out Your Banking App From the Inside
Hirudo is a sophisticated Android banking trojan that combines remote access capabilities with an unusual tactic: it detects legitimate banking apps on a victim's device, uninstalls them, and replaces them with trojanized copies that neutralize security checks from within the app itself. Delivered via convincing dropper apps promoted on social media, it currently targets eight Indonesian banking apps and can steal credentials, provide live remote device control, and collect SMS messages. Security researchers at ThreatFabric warn that this approach — moving tampering inside the target app rather than attacking the device externally — represents a significant escalation, and advise financial institutions to enforce integrity checks server-side and rely on layered behavioral analytics rather than trusting signals generated locally on the device.
Hirudo Trojan Swaps Out Your Banking App With a Fake One That Passes Its Own Security Checks
Hirudo is a newly identified Android banking trojan that replaces legitimate banking apps with tampered versions engineered to bypass the apps' own internal security checks, including signature verification, accessibility detection, and Play Integrity. Delivered through dropper apps disguised as shopping, entertainment, or adult video platforms — and promoted via fake Google Play pages advertised on Meta platforms — the malware targets banking users across Indonesia, China, India, Mexico, Morocco, and Thailand. Security firm ThreatFabric warns that Hirudo's approach of moving tampering *inside* target apps means locally generated security signals can no longer be trusted and must be verified server-side.
BadBox Botnet Comes for Your Car: First Malware Targeting Vehicle Head Units Discovered
Kaspersky researchers have discovered what appears to be the first malware specifically designed for car head units, found on Android-powered infotainment systems made by Chinese company DoFun. The malware was delivered by exploiting a vulnerability in the device's software update system, and is believed to be the work of the MoYu Group, a threat actor linked to the BadBox botnet. The attack suggests that BadBox operators are expanding beyond budget TV boxes and Android devices, now targeting vehicle infotainment systems to ensnare them in a proxy botnet used for ad fraud and other illegal schemes.
Your Car's Infotainment System Is Now a Botnet Node, Apparently
Kaspersky researchers have discovered a new malware family targeting Android-based car head units, marking the first documented case of malware using an infection chain specifically designed for vehicle systems. The malware, attributed to the MoYu Group, spreads through the legitimate built-in software update mechanism of DoFun firmware, deploying a multi-stage downloader that enables ad fraud and recruits devices into a proxy botnet. The threat highlights the growing security risks posed by internet-connected automotive platforms, as the infected head units' SIM card slots and Android compatibility make them increasingly attractive targets for cybercriminals.
Flying Eagle Android RAT Source Code Leaks, Fingerprints Spotted on 170 Servers
Source code for the Flying Eagle Android RAT framework is circulating on criminal Telegram channels, with researchers at Hunt.io and NetAskari identifying matching infrastructure on 170 internet servers, though this figure reflects server fingerprints rather than confirmed victims or active command-and-control systems. The toolkit, disguised as a fake Chinese public security app, supports keystroke and payment-password capture, screen recording, camera access, and phishing overlays, and its builder generates obfuscated APKs with encrypted C2 URLs. Researchers also identified a separate Android RAT called Night Dragon being promoted by one of the same Telegram channels, though it appears to be an independent, financially motivated tool unrelated to the 2011 espionage campaign of the same name.
Google and FBI Knock Out NetNut Proxy Network Backed by Millions of Infected Devices
Google, the FBI, and other partners disrupted NetNut (also known as Popa), a residential proxy network comprising over 2 million infected Android devices, including smart TVs and streaming boxes compromised through malicious apps. The network, linked to Israeli firm Alarum Technologies, rented proxy access to cybercriminals and espionage groups, with 316 distinct threat clusters observed using it in a single week. Google's actions included disabling associated accounts, dismantling backend infrastructure, and removing infected apps via Google Play Protect, resulting in a significant reduction in the botnet's available devices.
NFCShare Malware Evolves: Fake Banking App Updates Delivered Via GitHub
A new Android malware called NFCShare is being distributed through fake banking app updates hosted on GitHub, targeting customers of banks primarily in Italy and Spain. The malware tricks victims into scanning their payment cards near their phone's NFC chip under the guise of a security verification, stealing card details and PINs which are then sent to attackers for use in NFC payment relay fraud. Android users are advised to only download banking apps from Google Play, enable Play Protect, and be wary of any requests to scan their cards through an app.