Android

Hackers Target Android Users via WhatsApp to Steal Sensitive Data

Researchers analyzed a malicious Android sample created using Spynote RAT, targeting high-value assets in Southern Asia, which, likely deployed by an unknown threat actor, aims to compromise sensitive information. 

Although the target’s precise location and nature have not been disclosed, its high-value nature suggests that advanced persistent threat (APT) groups may be interested in it. 

The app was in the menu after the installation was over

A targeted Android attack was launched against high-value individuals in southern Asia as the threat actor attempted a less-than-ideal delivery method via WhatsApp, deploying four obfuscated payloads with similar names.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

These payloads, once installed, quickly concealed themselves and operated silently in the background, communicating with a common C&C server, where the attacker’s intent was likely to compromise the victim’s device and potentially exfiltrate sensitive data.

Analysis of the decompiled payload reveals malicious functionalities. The AndroidManifest file requests permissions for accessing precise location (ACCESS_FINE_LOCATION), reading contacts (READ_CONTACTS), camera (CAMERA), SMS (READ_SMS), and external storage (WRITE_EXTERNAL_STORAGE). 

Module to monitor call activity

These permissions allow the attacker to track the user’s location, steal contacts, potentially take pictures or videos, intercept SMS messages, and potentially exfiltrate data from the device’s storage. 

It also demonstrates the app’s ability to interact with the file system, monitor phone calls, and retrieve the user’s precise location, which suggests the payload is designed for comprehensive data collection and espionage. 

The malicious code attempts to gain unauthorized access to sensitive device information by exploiting the device’s accessibility settings to monitor user activity, potentially capturing screen content and keystrokes. 

According to Cyfirma, it also extracts critical device details like the IMEI number, SIM information, Android version, network type, and IMSI, compromising the user’s privacy and security.

Module that exploits accessibility

SpyNote, a sophisticated Remote Administration Tool (RAT), has been exploited by various threat actors, including APT groups like OilRig, APT-C-37, and OilAlpha, which have leveraged SpyNote to target critical sectors and individuals, compromising Android devices to steal data and maintain persistent access. 

The tool’s versatility and adaptability have made it a preferred choice for malicious actors, highlighting the evolving threat landscape and the need for robust security measures to counter such attacks. 

A high-value target in Southern Asia was attacked by an unidentified threat actor or an unknown APT group, where the attack employed the publicly available SpyNote malware, demonstrating the threat actor’s preference for this tool in targeting high-profile individuals.

Analyse Real-World Malware & Phishing Attacks With ANY.RUN - Get up to 3 Free Licenses

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems across…

2 hours ago

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21 popular…

2 hours ago

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its focus…

2 hours ago

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu, has…

2 hours ago

Hackers Use Pahalgam Attack-Themed Decoys to Target Indian Government Officials

The Seqrite Labs APT team has uncovered a sophisticated cyber campaign by the Pakistan-linked Transparent…

3 hours ago

LUMMAC.V2 Stealer Uses ClickFix Technique to Deceive Users into Executing Malicious Commands

The LUMMAC.V2 infostealer malware, also known as Lumma or Lummastealer, has emerged as a significant…

3 hours ago