Malware

ViceLeaker

ViceLeaker is an Android surveillance malware family with broad on-device collection and exfiltration capabilities. It has been observed embedded into otherwise legitimate Android applications through Smali injection and distributed primarily through messaging platforms such as Telegram and WhatsApp, aligning with a trojanized-app delivery model.

Its functionality includes collecting SMS messages, harvesting call logs, enumerating installed applications, copying arbitrary files from the device, exfiltrating browsing history and SD card structure, and capturing pictures as they are taken. It also supports active surveillance through recording audio from the microphone, recording phone calls together with caller ID, and taking photos with both the front and rear cameras. In addition, it can delete arbitrary files from the device, indicating both collection and defense-evasion or cleanup capability.

ViceLeaker communicates with command-and-control infrastructure and exfiltrates stolen data over HTTP. The malware is associated with post-compromise mobile espionage behavior focused on persistent monitoring and theft of locally stored and user-generated data from infected Android devices.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

Bouncing Golf distributed malware as repackaged legitimate applications, with the malicious code in the com.golf package.

Execution

1 technique

T1574Hijack Execution FlowEvidence1

ViceLeaker was embedded into legitimate applications using Smali injection.

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

ViceLeaker was embedded into legitimate applications using Smali injection.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence2

BOULDSPY can access browser history and bookmarks, and can list all files and folders on the device. RatMilad has listed files and pictures on the device starting from /mnt/sdcard/.

Collection

1 technique

T1005Data from Local SystemEvidence3

Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

SpyNote RAT can copy files from the device to the C2 server. ViceLeaker can copy arbitrary files from the device to the C2 server, can exfiltrate browsing history, can exfiltrate the SD card structure, and can exfiltrate pictures as the user takes them.

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence2

BRATA has exfiltrated data to the C2 server using HTTP requests.

ACTIVITY FEED

Recent activity

25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

25 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Capture Camera, Technique T1512 - Mobile | MITRE ATT&CK®

Android malware that can take photos from both front and back cameras.

mitre attack websiteNews

Oct 21, 2021

Application Discovery, Technique T1418 - Mobile | MITRE ATT&CK®

Mobile espionage spyware that obtains installed application lists.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1533 - Mobile | MITRE ATT&CK®

Android spyware that exfiltrates arbitrary files, browsing history, SD card structure, and live-taken pictures.

mitre attack websiteNews

Oct 21, 2021

Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®

Android trojan embedded into legitimate applications through Smali injection.

+21 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ViceLeaker