Loading malware…
Octagon is a multi-stage Android malware family used in campaigns that impersonate Bahrain’s official BH Alert emergency application to infect users outside official app stores. It is designed as a modular remote-access and surveillance threat that minimizes its static footprint by decrypting and dynamically loading additional DEX and JAR payloads at runtime, then installing a secondary component to expand functionality.
After launch, Octagon walks victims through a staged permission-granting process to obtain high-risk access, including Accessibility and VPN-related permissions and the ability to install additional applications. It abuses Android VPN functionality to intercept and redirect device traffic, enabling theft of sensitive information including banking-related data while excluding selected applications from tunneling to reduce user suspicion. A child component further abuses Accessibility Service to monitor lock-screen activity and capture PINs, passwords, and unlock patterns. Octagon also collects SMS messages, contacts, call records, screenshots, configuration data, and supports phishing overlays against targeted applications.
The malware stores stolen data, phishing templates, targeted application lists, intercepted messages, and operational state in local storage and a SQLite database before transmitting them to operator-controlled infrastructure over encrypted channels. Persistence is achieved through multiple Android mechanisms, including boot-time relaunch, paired watchdog-style background services, and abuse of AccountManager and Sync Adapter through registration of a fake account with periodic synchronization. Octagon also maintains configuration and anti-removal settings locally to preserve long-term access.
The campaign has been associated with targeting users in Bahrain through phishing-hosted APK delivery masquerading as a trusted government-themed mobile application. Its combination of staged loading, credential theft, traffic interception, phishing support, and resilient persistence makes it a capable Android remote-access threat focused on surveillance and financial data theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
The SyncHelper class as shown in Figure 14, abuses Android’s AccountManager and Sync Adapter framework by registering a fake account (OctagonPanel) and enabling periodic synchronization every 30 minutes.
The malware then installs a child application known as OctagonPanel and creates another code file at runtime.
The SyncHelper class as shown in Figure 14, abuses Android’s AccountManager and Sync Adapter framework by registering a fake account (OctagonPanel) and enabling periodic synchronization every 30 minutes.
The SyncHelper class as shown in Figure 14, abuses Android’s AccountManager and Sync Adapter framework by registering a fake account (OctagonPanel) and enabling periodic synchronization every 30 minutes.
The SyncHelper class as shown in Figure 14, abuses Android’s AccountManager and Sync Adapter framework by registering a fake account (OctagonPanel) and enabling periodic synchronization every 30 minutes.
The SyncHelper class as shown in Figure 14, abuses Android’s AccountManager and Sync Adapter framework by registering a fake account (OctagonPanel) and enabling periodic synchronization every 30 minutes.
Our analysis revealed that the malware extracts an encrypted payload (ZfChs.ttf) from the application’s assets directory, decrypts it using an RC4-based routine
The child app also gathers SMS messages, contacts, call records, screenshots and configuration data, and can display phishing pages over targeted applications.
Accessibility is meant to help people use phones, but here it records lock-screen PINs, passwords and patterns as they are entered.
The database stores targeted application lists, malware configuration, phishing templates, intercepted SMS messages, and pending responses awaiting transmission to the C2 server.
The child app also gathers SMS messages, contacts, call records, screenshots and configuration data, and can display phishing pages over targeted applications.
Persisting these values ensures that the malware preserves its runtime state across device reboots and subsequent application launches.
Upon activation, it establishes a malicious VPN tunnel to intercept and redirect all device traffic, facilitating the exfiltration of banking credentials and other sensitive information.
The malware performs an in-memory installation of the embedded payload (payload.base) by streaming it from the application’s assets into a PackageInstaller session, without first creating a standalone APK file on disk
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware masquerading as Bahrain’s BH Alert emergency app. It uses a staged installation flow, decrypts hidden code at runtime, installs a child component, persists across reboots via boot receivers and paired watchdog services, abuses Accessibility to capture PINs/passwords/patterns, requests a rogue VPN to intercept or redirect traffic, steals SMS, contacts, call logs, screenshots, banking information and other device data, and overlays phishing pages on targeted apps.
Multi-stage Android malware that impersonates Bahrain's BH Alert app, dynamically loads encrypted DEX/JAR payloads, abuses VPN and Accessibility services, installs a child APK, captures lock-screen credentials, intercepts SMS and other sensitive data, stores stolen data locally, and communicates with a C2 server for long-term device control.
A multi-stage Android malware family that impersonates Bahrain's BH Alert app, dynamically loads encrypted DEX/JAR payloads, abuses VPN and Accessibility services, installs a child APK, captures lock-screen credentials, intercepts SMS and other sensitive data, stores stolen data locally, and communicates with a configurable C2 server for long-term device control.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.