Loading malware…
AndroSnitch is an Android information-stealing payload that collects and exfiltrates Chrome cookies, saved login credentials, browsing history, and saved Wi-Fi credentials and settings. Its theft of browser cookies exposes authenticated sessions to potential reuse. It does not establish persistence, and its execution chain terminates when it detects a Samsung Galaxy S25 Ultra.
AndroSnitch has been deployed in Poisoned Source, a mobile watering-hole espionage campaign attributed to the Russian state-linked group APT29, also known as Midnight Blizzard or Cozy Bear. Delivery uses compromised legitimate websites, lookalike websites, and a compromised Plerdy analytics tracker. Visitor-profiling JavaScript selects a device-specific exploit chain, allowing a website visit to trigger compromise without further interaction. The Android chain targets Chrome versions 139 through 145, excluding version 143, and exploits CVE-2026-3910 and the Adreno graphics driver vulnerability CVE-2025-27038 to obtain code execution, escape the browser sandbox, and escalate privileges before deploying AndroSnitch. These exploitation capabilities belong to the delivery chain rather than the information-stealing payload itself. Campaign exposure included military- and defense-related websites, a Ukrainian gas producer, and a U.S. chemical-industry trade association. AndroSnitch is distinct from ANDROSNATCH, an earlier Android Chrome cookie-stealing payload whose similarities inspired its name.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Class C ... exploits CVE-2026-3910 and CVE-2025-27038 to achieve remote code execution, sandbox escape, privilege escalation, and ultimately deliver AndroSnitch to collect Chrome data and Wi-Fi passwords.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.