Loading malware…
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The campaign relies on a network of lookalike domains, and victims are tricked into downloading a malicious APK hosted outside official app stores; the initial infection vector is likely smishing or malicious links distributed via social media and messaging platforms.
The initial infection vector is likely smishing or malicious links distributed via social media and messaging platforms.
The initial infection vector is likely smishing or malicious links distributed via social media and messaging platforms.
Octagon adds a fake Android account, OctagonPanel, and schedules synchronization every 30 minutes. The routine can wake the malware periodically or on demand
The malware then installs a child application known as OctagonPanel and creates another code file at runtime.
An RC4-encrypted loader disguised as a font file (ZfChs.ttf) injects hidden DEX code into the device once the trojanized APK is installed.
Victims are tricked into downloading a malicious APK hosted outside official app stores.
The malware establishes persistence using foreground services, watchdog processes, and boot receivers to survive reboots and removal attempts.
Octagon adds a fake Android account, OctagonPanel, and schedules synchronization every 30 minutes. The routine can wake the malware periodically or on demand
Its services operate in the background, while watchdog processes monitor one another and restart a partner if it is stopped.
The OctagonPanel / Ward RAT establishes full device surveillance and command-and-control, abusing Accessibility Services to harvest PINs, OTPs, and banking credentials.
The malware establishes persistence using foreground services, watchdog processes, and boot receivers
The malware establishes persistence using foreground services, watchdog processes, and boot receivers to survive reboots and removal attempts.
Octagon adds a fake Android account, OctagonPanel, and schedules synchronization every 30 minutes. The routine can wake the malware periodically or on demand
Its services operate in the background, while watchdog processes monitor one another and restart a partner if it is stopped.
The OctagonPanel / Ward RAT establishes full device surveillance and command-and-control, abusing Accessibility Services to harvest PINs, OTPs, and banking credentials.
The malware establishes persistence using foreground services, watchdog processes, and boot receivers
The malware incorporates several anti-analysis controls: RC4-encrypted payloads hidden inside .ttf font files and .jar archives. Obfuscated code paths and junk logic to hinder reverse engineering.
This advisory is issued to raise awareness of a sophisticated Android malware campaign distributing a fake “BH Alert” app impersonating Bahrain's Civil Defense emergency alert application.
An RC4-encrypted loader disguised as a font file injects hidden DEX code... a secondary RC4 shell decrypts and executes the main RAT payload
A notable technical mechanism involves... Runtime code injection directly into the Android classloader.
Once installed, the RAT abuses Android Accessibility Services and elevated system permissions to gain granular control over the device, including lockscreen theft | Once installed, the RAT abuses Android Accessibility Services and elevated system permissions to gain granular control over the device, including lockscreen theft, interception of SMS and OTP codes, phishing overlays mimicking banking apps
Display phishing overlays over legitimate banking applications
Phishing Overlays: Displaying fake login forms over banking apps, mirroring tactics seen in banking trojan campaigns.
A compromised employee smartphone could potentially be used to bypass multifactor authentication (MFA) protections and gain access to corporate applications.
Intercept SMS messages and one-time passwords used for banking authentication
A notable technical mechanism involves deploying a fake VPN service that intentionally disrupts normal device connectivity. While legitimate applications lose internet access, attacker-controlled components remain functional.
The child app also gathers SMS messages, contacts, call records, screenshots and configuration data
Once installed, the RAT abuses Android Accessibility Services and elevated system permissions to gain granular control over the device, including lockscreen theft | Once installed, the RAT abuses Android Accessibility Services and elevated system permissions to gain granular control over the device, including lockscreen theft, interception of SMS and OTP codes, phishing overlays mimicking banking apps
Display phishing overlays over legitimate banking applications
Phishing Overlays: Displaying fake login forms over banking apps, mirroring tactics seen in banking trojan campaigns.
The child app also gathers SMS messages, contacts, call records, screenshots and configuration data
Exercise remote administrative control of infected devices via encrypted C2 communication
The malware establishes persistence using foreground services, watchdog processes, and boot receivers, and notably deploys a fake VPN service that disrupts normal device connectivity for legitimate apps while keeping the attacker's own communication channel functional.
Stage 1 ( com.kit.kitty ): Social engineering interface requests permissions and installs a secondary APK payload.
OctagonPanel is the primary RAT, capable of intercepting SMSs, harvesting contacts, capturing screenshots, conducting accessibility-based surveillance, stealing credentials, adding banking app phishing overlays, controlling remote devices, and maintaining persistence after reboot.
OctagonCipher encrypts this traffic using AES in GCM mode with no padding.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.