Sunday, June 15, 2025
HomeAndroidHackers Compromise iOS & Android Devices by Dropping Malware Over Hijacked WiFi...

Hackers Compromise iOS & Android Devices by Dropping Malware Over Hijacked WiFi Routers

Published on

SIEM as a Service

Follow Us on Google News

Cybercriminals attempting to compromise iOS & Android devices via advanced Phishing campaign that redirect iOS users to a malicious landing page which allows attackers to collect sensitive information and the Android users are compromised with malware via Hijacked WiFi Routers.

Researchers believe that the attack belongs to Roaming Mantis campaign that uses DNS hijacking attack to hack Android smartphones, current attack carries updates on their tools and tactics.

In order to compromise iOS devices and to collect the data, attackers let
iPhone user visits a new landing page where the user forced to download the malicious iOS mobile config installation.

- Advertisement - Google News

After the installation process, users redirect into the phishing site that automatically opens in a web browser and collected information from the device will be sent to the attacker’s server.

Once users enter their credentials then it redirects to the next page, which tried to steal the two-factor authentication code (PIN) sent to the device.


Phishing page for stealing apple ID and two-factor authentication

Malicious APK Targets an Android

Researchers discovered another malicious APK which is a variant of sagawa.apk, a malware that was earlier distributed via SMS in Japan.

According to Kaspersky, We also found out that the threat actors had compromised WiFi routers to overwrite DNS settings and discovered that the following two features were updated as well to compromise Android devices.:

  • Decryption algorithm for encrypted payload in Trojan-Dropper module
  • Stored destination and accounts for getting real C2

This new campaign affected many countries includes Russia, Japan, India, Bangladesh, Kazakhstan, Azerbaijan, Iran and Vietnam

Also, researchers detected this malware over 6,800 times for over 950 unique users during this period.

Beware …

  • Change the default ID and password, and apply the relevant security patches to counter these threats;
  • For Android users: do not download APKs from third-party sources;
  • For iOS users: do not install a non-trusted third-party mobile config.

Indicator of Compromise:

417a6af1172042986f602cc0e2e681dcAPK file
651b6888b3f419fc1aac535921535324APK file
0a4e8d3fe5ee383ba3a22d0f00670ce3APK file
870697ddb36a8f205478c2338d7e6bc7APK file
7e247800b95c643a3c9d4a320b12726b\classes.dex
7cfb9ed812e0250bfcb4022c567771ec\classes.dex
8358d2a39d412edbd1cf662e0d8a9f19\classes.dex
7cfb9ed812e0250bfcb4022c567771ec\classes.dex
af2890a472b85d473faee501337564a9Decrypted dex file
c8d7475a27fb7d669ec3787fe3e9c031Decrypted dex file
d0848d71a14e0f07c6e64bf84c30ee39Decrypted dex file
e2b557721902bc97382d268f1785e085Decrypted dex file

Course: Learn Malware Analysis – Advance Malware Analyst Bundle

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Cybercriminals Exploiting Expired Discord Invite Links to Deploy Multi-Stage Malware

Recent investigations by Check Point Research have uncovered a sophisticated malware campaign that leverages...

Interpol Dismantles 20,000 Malicious IPs and Domains Tied to 69 Malware Variants

In a landmark global cybercrime crackdown, INTERPOL’s Operation Secure has seen the takedown of...

New Secure Boot Vulnerability Allows Attackers to Install Malware in PC and Server Boot Processes

Security researchers from Binarly have uncovered a major software vulnerability in the Unified Extensible...