Android

Hackers Target Android Users via WhatsApp to Steal Sensitive Data

Researchers analyzed a malicious Android sample created using Spynote RAT, targeting high-value assets in Southern Asia, which, likely deployed by an unknown threat actor, aims to compromise sensitive information. 

Although the target’s precise location and nature have not been disclosed, its high-value nature suggests that advanced persistent threat (APT) groups may be interested in it. 

The app was in the menu after the installation was over

A targeted Android attack was launched against high-value individuals in southern Asia as the threat actor attempted a less-than-ideal delivery method via WhatsApp, deploying four obfuscated payloads with similar names.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

These payloads, once installed, quickly concealed themselves and operated silently in the background, communicating with a common C&C server, where the attacker’s intent was likely to compromise the victim’s device and potentially exfiltrate sensitive data.

Analysis of the decompiled payload reveals malicious functionalities. The AndroidManifest file requests permissions for accessing precise location (ACCESS_FINE_LOCATION), reading contacts (READ_CONTACTS), camera (CAMERA), SMS (READ_SMS), and external storage (WRITE_EXTERNAL_STORAGE). 

Module to monitor call activity

These permissions allow the attacker to track the user’s location, steal contacts, potentially take pictures or videos, intercept SMS messages, and potentially exfiltrate data from the device’s storage. 

It also demonstrates the app’s ability to interact with the file system, monitor phone calls, and retrieve the user’s precise location, which suggests the payload is designed for comprehensive data collection and espionage. 

The malicious code attempts to gain unauthorized access to sensitive device information by exploiting the device’s accessibility settings to monitor user activity, potentially capturing screen content and keystrokes. 

According to Cyfirma, it also extracts critical device details like the IMEI number, SIM information, Android version, network type, and IMSI, compromising the user’s privacy and security.

Module that exploits accessibility

SpyNote, a sophisticated Remote Administration Tool (RAT), has been exploited by various threat actors, including APT groups like OilRig, APT-C-37, and OilAlpha, which have leveraged SpyNote to target critical sectors and individuals, compromising Android devices to steal data and maintain persistent access. 

The tool’s versatility and adaptability have made it a preferred choice for malicious actors, highlighting the evolving threat landscape and the need for robust security measures to counter such attacks. 

A high-value target in Southern Asia was attacked by an unidentified threat actor or an unknown APT group, where the attack employed the publicly available SpyNote malware, demonstrating the threat actor’s preference for this tool in targeting high-profile individuals.

Analyse Real-World Malware & Phishing Attacks With ANY.RUN - Get up to 3 Free Licenses

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications

Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on…

8 hours ago

Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage

Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI)…

8 hours ago

Critical Vulnerability in Netwrix Password Manager Enables Authenticated Remote Code Execution

A critical security vulnerability has been discovered in Netwrix Password Secure, a widely used enterprise…

8 hours ago

Cityworks Zero-Day Vulnerability Used by UAT-638 Hackers to Infect IIS Servers with Shell Malware

Cisco Talos has uncovered active exploitation of a zero-day remote-code-execution vulnerability, identified as CVE-2025-0994, in…

10 hours ago

Researchers Warn of ‘Smiao Network’ Cyber Threat Against Taiwan’s Federal Staff

The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 has exposed an intricate…

10 hours ago

Vidar and StealC Malware Delivered Through Viral TikTok Videos by Hackers

A sophisticated social engineering campaign that leverages the viral power of TikTok to distribute dangerous…

10 hours ago