Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Malware

SpyLoan

SpyLoan is an Android malware/riskware family embedded in predatory loan applications, including apps distributed through Google Play, that masquerade as quick-loan or low-friction lending services. It has been active since at least 2020 and has been described as a repeat offender. The apps use social engineering to lure users with promises such as fast cash, low-interest loans, and minimal checks, and in some cases were also promoted via Facebook posts. Once installed, SpyLoan apps request intrusive permissions and harvest extensive victim data, including contacts, SMS messages, call logs, device identifiers and system information, coarse location, camera access, identification documents, bank account details, employment information, and personal photos. Reported behavior includes validating victims with one-time-password checks tied to targeted regions and exfiltrating stolen data to command-and-control servers, with some reporting noting AES-128 encryption and shared exfiltration/C2 frameworks across samples. The stolen information is used for harassment, extortion, inflated repayment demands, identity abuse, and surveillance. Reported targets span users in Latin America, Africa, and Asia, including Mexico, Colombia, Senegal, Thailand, Indonesia, Vietnam, Tanzania, Peru, and Chile. Multiple reports tie SpyLoan to surveillance, extortion, and identity theft, and Kaspersky classified it among frequently seen Android RiskTool apps while Zscaler identified it as a major driver of a year-over-year rise in Android spyware activity. Check Point also reported SpyLoan extortion malware in a Google Play app named RapiPlata. McAfee documented 15 SpyLoan-infected Android apps on Google Play with more than 8 million combined downloads, and ESET previously reported another set of 18 SpyLoan apps stealing personal and financial data. Shared code and infrastructure suggest either a common developer or a reusable criminal framework used by multiple operators.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques
T1059Command and Scripting InterpreterEvidence1

Despite differences in the targeting, the apps have been found to share a common framework to encrypt and exfiltrate data from a victim's device to a command-and-control (C2) server.

T1204User ExecutionEvidence1

These PUP (potentially unwanted programs) applications use social engineering tactics to trick users into providing sensitive information and granting extra mobile app permissions, which can lead to extortion, harassment, and financial loss.

Credential Access

2 techniques
T1056Input CaptureEvidence1

The end goal of the financial scheme is to collect as much information as possible from infected devices, which could then be used to extort users by coercing them into paying the loans back at higher interest rates, and in some cases, for delayed payments or intimidating them with stolen personal photos.

T1621Multi-Factor Authentication Request GenerationEvidence1

Users who register for the service are validated via a one-time password (OTP) to ensure they have a phone number from the target region.

Collection

1 technique
T1056Input CaptureEvidence1

The end goal of the financial scheme is to collect as much information as possible from infected devices, which could then be used to extort users by coercing them into paying the loans back at higher interest rates, and in some cases, for delayed payments or intimidating them with stolen personal photos.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

Despite differences in the targeting, the apps have been found to share a common framework to encrypt and exfiltrate data from a victim's device to a command-and-control (C2) server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
7 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app
domain●●●●●●●●●●●●View more in app
domain●●●●●●●●●●●●View more in app
domain●●●●●●●●●●●●View more in app
domain●●●●●●●●●●●●View more in app
domain●●●●●●●●●●●●View more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.