Loading malware…
2 distinct techniques documented for this family, organized by ATT&CK tactic.
This attack methodology represents a shift from Application Modification (changing the app) to Runtime Environment Manipulation (changing the world the app lives in). By using LSPosed, the threat actor ensures the payment app’s signature remains valid... it 'hooks' into the application’s memory while it is running, allowing the module to change the behavior of specific Java methods.
Because it operates at the system level, it can effectively 'blind' apps to their own security status... a malicious module can hook the system APIs that check for root access, making the device appear 'clean' to a banking app while the framework is simultaneously stealing data in the background.
This attack methodology represents a shift from Application Modification (changing the app) to Runtime Environment Manipulation (changing the world the app lives in). By using LSPosed, the threat actor ensures the payment app’s signature remains valid... it 'hooks' into the application’s memory while it is running, allowing the module to change the behavior of specific Java methods.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.