Loading story…
Android.Backdoor.Baohuo.1.origin was distributed by threat actors by embedding it into unofficial/modified Telegram X Android APKs hosted on third-party app catalogs and suspicious websites, rather than official app stores. Doctor Web reported roughly 58,000 infections spanning nearly 3,000 device models, including not only phones and tablets but also smart TVs and in-car systems, indicating broad opportunistic targeting via sideloaded apps.
Once installed, the backdoor enables extensive manipulation of a victim’s Telegram account, including joining/leaving channels, hiding login activity, and concealing messages to maintain persistent, covert access. The incident was highlighted alongside broader 2025 mobile threat trends reported by Doctor Web, including widespread adware/fake apps, riskware linked to app modification tooling (e.g., NP Manager), and continued activity from other Android malware families—reinforcing the operational risk of installing APKs from untrusted sources and using modified messenger clients.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
On January 15, 2026, Doctor Web published its review of mobile malware activity in 2025, disclosing technical and impact details of the Android.Backdoor.Baohuo.1.origin campaign. The report said the backdoor enabled extensive control over victims’ Telegram accounts, including manipulating channel membership and concealing activity and messages for stealthy persistence.
During 2025, modified unofficial Telegram X builds carrying Android.Backdoor.Baohuo.1.origin were distributed through third-party app catalogs and suspicious websites, primarily targeting users in Indonesia and Brazil. Doctor Web said the campaign infected more than 58,000 devices across over 3,000 Android device models, including phones, tablets, smart TVs, and in-car systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a malicious modified version of WhatsApp was being distributed through seemingly legitimate Android applications, allowing attackers to compromise users who installed the software outside official channels. The campaign relied on repackaged apps that appeared benign but delivered a trojanized WhatsApp mod, expanding the reach of malware through trusted-looking distribution paths rather than direct phishing alone. The activity highlights the risk posed by unofficial messaging clients and third-party app ecosystems, where attackers can hide malware inside popular software variants to steal data, abuse device access, or deploy additional payloads. The incident underscores that users and organizations should restrict installations to official app stores and vetted software sources, especially for high-use communications platforms such as **WhatsApp**.
Jul 12, 2026
Researchers reported that **BTMob** is operating as an Android banking malware and fraud-as-a-service platform that lets multiple criminal actors create branded malicious apps and run large-scale device-takeover campaigns. Analysis of leaked source packages and exposed infrastructure linked the operation to roughly **1,400 live servers**, including command-and-control nodes, an automated APK-building ecosystem, and backend components used to manage victim infections and operator access. The platform is being spread through fake apps, cloned download pages, and social-engineering lures, including WhatsApp messages and phone calls in Brazil that pressure victims to sideload APKs and grant dangerous permissions. Investigators tied the activity to infrastructure using `/yaarsa/` PHP backend paths, HTTP and WebSocket endpoints, a control panel on port `3000` identified by the string **"painel de controle elite"**, and payloads including `lnat-tv-pro.apk`, `BTMob.exe`, `SolrStarter.exe`, and `SolrWorker.exe`, while also linking the operation to the earlier **CraxsRAT** and **SpySolr** malware families.
Aug 22, 2026
Threat actors used **COVID-19-themed lures** to push Android malware through SMS phishing and unofficial download sites, targeting users with fake alerts, safety tools, and public-health claims. Proofpoint reported that the **TangleBot** campaign sent text messages in the United States and Canada themed around coronavirus information and power outages, directing Android users to links that served a malicious APK and a fake **Adobe Flash Player** update prompt. Separately, researchers documented a fake **"Corona Safety Mask"** app and similar coronavirus-themed Android packages that were distributed outside official app stores and promoted through deceptive websites and messages. Once installed, the malware gave operators extensive access to infected devices. TangleBot supported surveillance and device control features including **keylogging, SMS and call control, screen capture, camera and microphone access, GPS tracking, clipboard access, and overlay injection**, while using obfuscation and Telegram-based command-and-control discovery to hinder analysis. The other Android trojan focused on propagation by requesting permission to read contacts and send SMS messages, harvesting address books and sending malicious texts with download links to additional victims; researchers also warned the app appeared capable of evolving toward broader fraud or theft functions.
Aug 15, 2026