Octagon, a previously undocumented Android banking and cryptocurrency fraud platform marketed as malware-as-a-service by a Russian-speaking actor using the handle AndroidKitKat.
First advertised on a Russian-language cybercrime forum on June 1, 2026, the toolkit combines abuse of accessibility, stealthy remote control, credential-stealing overlays, SMS interception, and device reconnaissance to enable direct account takeover and cryptocurrency theft.
AndroidKitKat offers Octagon subscriptions for $1,400 per month, positioning it as a turnkey platform for affiliates targeting crypto wallets, exchanges, banking applications, messaging services, and Android lock screens.
Version 1.2 was announced on June 29, indicating active development and a growing commercial operation.
Compromised devices appear in the panel as “Wards,” giving operators visibility into installed apps, screen content, account balances, and accessibility-node data.
The malware registers WardAccessibilityService and prompts victims to enable Android Accessibility Services.
Once granted, this permission allows the trojan to inspect interface elements in targeted applications, execute gestures, enter text, trigger global Android actions, and interact with security-sensitive screens without requiring traditional remote-access permissions.
This capability is particularly dangerous because the attacker can carry out fraud on the victim’s device, using the victim’s trusted session, IP address, installed apps, and potentially already-unlocked wallet or banking accounts.
That reduces the effectiveness of risk engines designed to detect logins from new devices or suspicious locations.
Octagon’s operators can use accessibility data to identify a wallet application, launch it, read visible balances, and deploy an application-specific phishing overlay.
The platform includes hidden VNC-style remote-control functionality that lets an operator view and manipulate the victim’s Android screen.
Commands can capture screenshots, enumerate installed applications, open packages, send taps and swipes, type text, and submit Android global actions.
Credential overlays are delivered through package-specific templates. When a targeted app is opened, Octagon can place an editable WebView above the legitimate interface and request a wallet seed phrase, password, PIN, or account-recovery detail.
iVerify’s threat intelligence team identified Octagon, is built around an Android client package identified as com.kisa.octagonpanel, which connects to a Windows-based command-and-control panel.
Captured submissions are reportedly returned to the panel through OctagonBridge as WardGateAnswer records.
The same framework can target Android System UI and vendor lock-screen components to capture unlock patterns, passwords, and PINs.
This provides attackers with a route to retain control even if victims attempt to secure an affected device after noticing suspicious activity.
The malware also supports one-time password theft. A sample dubbed “Lifted Dreams” requests permission to read, receive, and send SMS messages, then forwards incoming content to the operator as WardSmsReceived events.
This creates a direct path to intercept bank verification codes, exchange logins, password-reset messages, and transaction confirmations.
Researchers recovered three Octagon-linked APKs: “Octagon,” “Lifted Dreams,” and “BahrDate.”
Although their themes, command-and-control infrastructure, signing choices, and permission flows differ, they share the Ward and Guardian protocol, encryption routines, overlay assets, accessibility configuration, and embedded identifiers.
The client uses AES-GCM encryption for control traffic and communicates over TCP port 4444. Shared hunting artifacts include octagon-default-key-change-me, WardAccessibilityService, OctagonBridge, WARD_GATE_ANSWER, and GUARDIAN_SET_PACKAGE_TEMPLATES.
Supplied templates reportedly impersonate Trust Wallet, Binance, and MEXC, while affiliates can create custom HTML WebView pages for other targets such as MetaMask and TON Keeper.
One sample connected to 45.192.12[.]34:4444, while Lifted Dreams used 104.251.180[.]179:4444. Both should be treated as historical indicators rather than exhaustive infrastructure, because Octagon’s modular design allows affiliates to change hosts and cover content rapidly.
Persistence features include boot execution, foreground services, an isolated:guard process, AlarmManager and WorkManager watchdogs, Doze recovery, battery-optimization prompts, OEM autostart guidance, and silent-audio keepalive behavior.
These mechanisms aim to keep the client alive despite Android power-management controls.
Octagon’s delivery mechanism relies on sideloaded APKs disguised as unrelated applications.
The Lifted Dreams variant displays an embedded visual-novel game after permissions are granted, allowing the malicious service to remain active beneath a plausible victim-facing interface.
A related campaign documented by Dream Group used Bahrain Civil Defense branding, fake Play Store pages, government-themed lures, simulated installation prompts, and a multi-stage APK chain.
The final payload shared the Octagon package name, Ward and Guardian components, default encryption passphrase, port 4444 communications, and Fenrir Launcher cover URL, linking the campaign to the broader ecosystem.
Defenders should investigate sideloaded Android apps requesting accessibility access alongside package enumeration, foreground execution, wake locks, battery-optimization exclusions, and SMS permissions.
Network detections should prioritize encrypted outbound TCP sessions over port 4444, particularly when paired with Octagon’s shared client strings.
The campaign also demonstrates why Play Protect results alone cannot establish device safety. A victim may see “No harmful apps found” while a trojan continues to abuse permissions the victim has manually enabled.
Organizations with high-value crypto exposure should enforce mobile application controls, block sideloading where possible, monitor accessibility-service grants, and require wallet users to verify every seed-phrase prompt as malicious by default.
| Type | Value | Source |
|---|---|---|
| Handle | AndroidKitKat | Operator material |
| Underground presence | Russian-language cybercrime forums | Operator material |
| Package name | com.kisa.octagonpanel | All three local APKs |
| Default C2 key | octagon-default-key-change-me | All three local APKs |
| Control port | 4444/tcp | All three local APKs |
| SHA-256 APK hash | 3530b1600e059468e585d48482bb2f37 5edfe5cb5c23862b01d8405ab56376b9 | Local Octagon AP |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…