In recent months, a wave of sophisticated threats has targeted the Android ecosystem, affecting thousands of mobile devices around the world. Malware such as AntiDot, GodFather, and SuperCard X are exploiting technical vulnerabilities and human behavior to compromise apps, data, and digital identities. For corporate security managers (CISOs, IT Managers, etc.) as well as product executives (Product Owners and Project Managers), the stakes are very high.<\/p>\n
According to The Hacker News<\/em><\/a>, a new Android malware called AntiDot<\/strong> has already compromised<\/strong> more than 3,775 devices in 273 separate campaigns<\/strong>, leveraging malicious overlays, accessibility services, NFC attacks, and virtualized environments to steal sensitive data and banking credentials.<\/p>\n In this article we analyze:<\/strong><\/p>\n the techniques used by the Android malware mentioned above<\/p>\n<\/li>\n the implications for businesses security<\/p>\n<\/li>\n what an organization can (and should) do to avoid becoming the next victim<\/p>\n<\/li>\n<\/ul>\n Developed by the LARVA-398<\/strong> cybercriminal group, AntiDot is sold as Malware-as-a-Service (MaaS)<\/strong> on underground forums. It is a modular package that offers three main features:<\/p>\n Screen recording by abusing accessibility services<\/strong><\/p>\n<\/li>\n SMS interception<\/strong><\/p>\n<\/li>\n Data extraction from third-party apps,<\/strong> especially banking and crypto applications<\/p>\n<\/li>\n<\/ul>\n The malware is distributed via:<\/p>\n Geo-targeted phishing campaigns<\/p>\n<\/li>\n Malicious advertising networks (malvertising)<\/p>\n<\/li>\n Coincidental apps that masquerade as Google Play updates<\/p>\n<\/li>\n<\/ul>\n Once installed, the malware asks the user to enable accessibility permissions (if you missed the webinar where we talk about this, you can catch up by clicking here<\/a>)<\/em><\/strong>. Immediately after, it dynamically downloads and installs the malicious code, in a three-stage chain:<\/strong><\/p>\n The attacker then gains remote access to the device, can spy on activity, steal credentials, and control banking apps in real time.<\/strong><\/p>\n Test the strength of your mobile apps with DSA Pro, Mobisec’s in-depth security testing service.<\/p>\n Learn more<\/a><\/strong><\/p>\n<\/blockquote>\n One of AntiDot\u2019s most powerful weapons is its ability to create overlays<\/strong> that mimic the login screens of legitimate apps. When the user opens a banking or crypto app, the malware intercepts the event and displays a fake login<\/strong>, indistinguishable from the original.<\/p>\n The remote control module is built with MeteorJS<\/strong>, an open-source JavaScript framework that enables real-time communication between servers and clients. The C2 (Command & Control) interface is divided into sections and is so complex that it demonstrates that AntiDot is not an improvised malware, but a scalable platform for generating dark business.<\/strong><\/p>\n As if that were not enough, another parallel threat is represented by the GodFather<\/strong> malware, recently analyzed by Zimperium<\/em>. Unlike classic app-imitating Trojans, GodFather takes a radical approach: it creates a virtual sandbox<\/strong> inside the device, where it installs a real copy of the banking app.<\/p>\n In this isolated environment, the user enters credentials believing they are in the real app, while in reality they are completely observed and controlled by the malware.<\/p>\n GodFather also exploits:<\/p>\n A particularly worrying aspect is the ability to steal device unlock credentials<\/strong> (pattern, PIN or password), making the malware a dangerously complete tool.<\/p>\n If your app handles financial or personal data, you can’t rely on internal testing alone. Request an advanced pentest with DSA Pro and test every vulnerability.<\/strong> Another attack front concerns the fraudulent use of NFC technology.<\/strong> The SuperCard X malware<\/strong>, recently detected in Italy, exploits an open source tool (NFCGate) to:<\/p>\n intercept NFC traffic<\/strong> between smartphones and POS<\/p>\n<\/li>\n steal credit card data<\/strong><\/p>\n<\/li>\n send commands to the EMV chip<\/strong> for fraudulent transactions<\/p>\n<\/li>\n<\/ul>\n Distributed via apps disguised as useful tools, SuperCard X is a prime example of how legitimate technology can be exploited. Its spread is supported by Telegram channels and Chinese MaaS platforms.<\/p>\n To make matters worse, even official stores are not immune. The RapiPlata app, a fake loan app, has been downloaded over 150,000 times from Google Play and the Apple App Store. Once installed, the app:<\/p>\n Another group of apps, however, targeted crypto wallets<\/strong> by stealing seed phrases<\/strong> via WebView phishing.<\/p>\n Threats don\u2019t just come from third-party apps, your app can also become a lever for attack. With DSA Pro you can simulate real attack scenarios and fix vulnerabilities before hackers do.<\/p>\n\n
AntiDot Malware: An \u201cAll-Inclusive\u201d Service<\/h2>\n
\n
\n
\n
\n
GodFather Malware: Virtualization and Real App Theft<\/h2>\n
\n
\n
\nLearn more<\/a><\/strong><\/p>\n<\/blockquote>\nSuperCard X Malware: Real-Time NFC Attacks<\/h2>\n
\n
Malicious Apps on Official Stores: The RapiPlata Case<\/h2>\n
\n
\n