Loading malware…
Tool.NPMod is Dr.Web’s detection name for Android apps modified with the NP Manager utility. It is classified in the provided content as riskware rather than a malware family. NP Manager-modified apps were described as among the most active and widespread riskware programs observed in 2025, including being the most widespread riskware category in Dr.Web’s Q4 2025 Android telemetry. According to the content, NP Manager can modify Android applications to obfuscate and protect their code and embed functionality that bypasses digital signature verification after modification. The content does not attribute Tool.NPMod to a specific threat actor, campaign, or industry target, and it does not provide specific indicators of compromise beyond the fact that affected apps are modified using NP Manager and include signature-verification-bypass capability.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
malware writers continued actively using various tools for modding Android apps to shield their malware from anti-virus detection.
Topping the list of the most commonly detected potentially dangerous software were apps to which junk code has been added with the help of Android program modification tools... Currently, this technique is actively being used to protect banking trojans from anti-virus detection.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
App modification/obfuscation tool used to protect modified apps and bypass signature verification; frequently leveraged by threat actors to hinder detection and analysis.
NP Manager-based app modification that obfuscates code and embeds a module to bypass Android signature verification after modification.
Android app-modification tool/module used to bypass digital signature verification in modified apps.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.