NewApp Digest
search bot

static analysis

More Than 700 Malicious Android Apps Using NFC Relay to Exfiltrate Banking Credentials
AppWizard
October 30, 2025

More Than 700 Malicious Android Apps Using NFC Relay to Exfiltrate Banking Credentials

Cybersecurity researchers at zLabs have identified over 760 malicious Android applications that exploit Near Field Communication (NFC) and Host Card Emulation (HCE) technologies to steal payment data and facilitate fraudulent transactions. Since April 2024, these applications have evolved into a coordinated global operation targeting financial institutions in countries such as Russia, Poland, the Czech Republic, Slovakia, and Brazil. The threat actors have established around 70 command-and-control servers and use Telegram bots for data exfiltration. The malicious apps impersonate about 20 legitimate entities, focusing on Russian banks and international institutions like Santander and Google Pay. They utilize various strategies to compromise payment credentials, including scanner and tapper tools, and employ simplified interfaces resembling legitimate banking portals. The malware activates a Host Card Emulation service during NFC payment events for real-time data relay. To evade detection, the threat actors use name masquerading, code obfuscation, and software packing techniques. This campaign represents a significant escalation in NFC-based financial fraud, highlighting the risks associated with NFC payment privileges.
From infostealer to full RAT: dissecting the PureRAT attack chain
Tech Optimizer
October 10, 2025

From infostealer to full RAT: dissecting the PureRAT attack chain

An investigation revealed that a Python-based infostealer campaign led to the deployment of PureRAT, a sophisticated remote access trojan (RAT). The campaign began with a phishing email containing a ZIP archive that included a legitimate PDF reader executable and a malicious DLL. The DLL executed a series of payloads, including a Python info-stealer that harvested sensitive data and exfiltrated it via the Telegram API. The attack progressed to a .NET executable, which employed techniques like process hollowing and evasion tactics to load additional payloads. The final payload, Mhgljosy.dll, was identified as PureRAT, which established an encrypted command-and-control (C2) channel and allowed for extensive control over the compromised host. The C2 server was traced to Vietnam, suggesting a connection to the PXA group. The malware's functionality included host fingerprinting, command execution, and potential access to sensitive information and resources. Indicators of compromise included specific file hashes, registry keys, and IP addresses associated with the C2 server.
224 Malicious Android Apps on Google Play With 38 Million Downloads Delivering Malicious Payloads
AppWizard
September 17, 2025

224 Malicious Android Apps on Google Play With 38 Million Downloads Delivering Malicious Payloads

A mobile ad fraud operation called "SlopAds" infiltrated the Google Play Store with 224 malicious applications, which collectively achieved over 38 million downloads across 228 countries. The operation utilized advanced steganography and obfuscation techniques to deliver fraudulent advertising payloads while avoiding detection. SlopAds activated its fraud system selectively based on specific advertising campaigns, generating around 2.3 billion fraudulent bid requests daily, primarily from the United States (30%), India (10%), and Brazil (7%). The malicious apps exploited Firebase Remote Config to retrieve encrypted data for downloading a primary fraud module named "FatModule." This module was concealed within PNG image files, allowing it to bypass traditional security measures. The FatModule included anti-analysis features to evade detection by security researchers. Google has since removed all identified SlopAds applications from the Play Store and implemented protections through Google Play Protect.
38 Million Downloads Across 224 Malicious Android Apps on Google Play Deliver Harmful Payloads
AppWizard
September 17, 2025

38 Million Downloads Across 224 Malicious Android Apps on Google Play Deliver Harmful Payloads

Researchers from HUMAN’s Satori Threat Intelligence and Research Team discovered a digital advertising fraud operation called “SlopAds,” which involves 224 Android applications that have over 38 million downloads across 228 countries. SlopAds employs a multi-layered obfuscation strategy to deploy fraud modules that siphon ad revenue. The applications connect to Firebase Remote Config to retrieve an encrypted configuration that conceals URLs for PNG images containing fragments of an APK, which are reassembled to create the core fraud component known as FatModule. SlopAds generates approximately 2.3 billion bid requests daily, primarily targeting users in the United States (30%), India (10%), and Brazil (7%). Google Play Protect alerts users and blocks known SlopAds applications, and Google has removed these applications from the Play Store. Users who installed these apps from off-market sources remain vulnerable until they uninstall them.
Why Malware Eradication Is Mathematically Impossible
Tech Optimizer
September 1, 2025

Why Malware Eradication Is Mathematically Impossible

The complete elimination of malware may be impossible due to fundamental mathematical truths, specifically the undecidability of certain computational problems, which prevents any system from perfectly distinguishing between benign and malicious code. This concept is linked to Alan Turing’s halting problem, indicating that no algorithm can definitively determine if a program will run indefinitely or stop. AI-driven malware can exploit these vulnerabilities by creating variants that evade detection. Polymorphic malware changes with each infection, complicating detection efforts. A study highlights that while AI improves threat intelligence, it also enables adversaries to develop advanced malware. The rise of infostealer malware on macOS has increased by 28%, showcasing the challenges in identifying malicious intent. Organizations are shifting towards layered defense strategies, focusing on monitoring runtime behavior rather than solely on pre-execution checks. Education on phishing and safe online practices remains crucial in reducing infection risks. Future defenses may involve quantum-resistant algorithms, but they won't solve the issue of undecidability. Proactive intelligence sharing and ethical AI development are essential for managing evolving threats.
Malicious Android apps with 19M installs removed from Google Play
AppWizard
August 25, 2025

Malicious Android apps with 19M installs removed from Google Play

Zscaler's ThreatLabs team discovered 77 malicious Android applications on Google Play that collectively garnered over 19 million downloads. The Anatsa (Tea Bot) banking trojan was identified as the main threat, evolving to target 831 banking and cryptocurrency apps. More than 66% of the malicious apps contained adware, while nearly 25% were infected with Joker malware, which can perform intrusive actions like sending texts and accessing sensitive information. A variant of Joker, named Harly, disguises itself within legitimate applications. Anatsa employs various evasion tactics, including using a decoy app to download its payload post-installation and altering package names to complicate detection. Following the findings, Google removed the identified malicious apps from the Play Store, and users are advised to ensure their Play Protect service is active and to take precautions if infected.
Threat Actors Abuse Microsoft Help Index File to Execute PipeMagic Malware
Winsage
August 19, 2025

Threat Actors Abuse Microsoft Help Index File to Execute PipeMagic Malware

Cybersecurity researchers have identified a malware campaign that uses Microsoft Help Index Files (.mshi) to deploy the PipeMagic backdoor, which has primarily targeted organizations in Saudi Arabia and Brazil in 2025. PipeMagic first appeared in December 2022 during a RansomExx ransomware campaign and exploits CVE-2025-29824, a vulnerability recognized by Microsoft as actively exploited. The malware has evolved from exploiting CVE-2017-0144 to using advanced social engineering techniques. The latest campaign employs .mshi files containing obfuscated C# code and encrypted payloads, utilizing the MSBuild framework for execution to bypass security controls. The infection process begins with executing a malicious metafile.mshi, which decrypts shellcode using an RC4 stream cipher and executes it via the Windows API function EnumDeviceMonitor. The decrypted shellcode is designed for 32-bit Windows systems and uses evasion techniques to complicate analysis, ultimately establishing the PipeMagic backdoor on the system and enabling communication through a named pipe at 127.0.0.1:8082.
Search