Loading story…
CISA and the UK National Cyber Security Centre published a joint malware analysis report on Infamous Chisel, an Android-focused malware family attributed to Russia’s military intelligence unit GRU 85th Main Special Service Center (GTsSS), Unit 26165. The malware was identified on Android tablets used by the Ukrainian military and is described as a collection of components that provide persistent access, periodic device scanning, file exfiltration, and traffic tunneling from compromised devices. The agencies said the capability appears designed primarily for espionage, enabling operators to harvest sensitive military information from infected devices.
The report says Infamous Chisel can search directories and file types of operational interest, monitor network information, and use modules based on tools such as Tor and SOCKS to route traffic through infected Android devices. Analysts noted the malware was likely deployed through physical access or other compromise methods rather than broad app-store distribution, and assessed some code as poorly obfuscated and narrowly tailored to the operational environment. The publication provides technical indicators and defensive guidance to help organizations detect the malware, investigate Android device compromise, and reduce exposure to mobile espionage activity.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
CISA and the UK National Cyber Security Centre released a joint malware analysis report on Infamous Chisel, detailing the malware's capabilities and technical characteristics. The publication disclosed technical findings intended to support detection and analysis of the malware.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Chameleon** Android banking trojan has evolved from consumer-focused banking fraud into campaigns aimed at employees, broadening the risk from personal account theft to potential compromise of **business banking access**. First observed targeting users in Australia and Poland while impersonating brands such as **CoinSpot**, a government agency, and Poland’s **IKO** bank, the malware later appeared in campaigns against victims in Canada and Europe disguised as a **CRM application** for hospitality workers and, separately, as a fake bank security app. Researchers said the operators appear to be using trusted-brand impersonation and workplace-themed lures to steal credentials from devices that may also provide access to corporate financial systems. Chameleon abuses Android’s **Accessibility Service** to automate permissions, disable **Google Play Protect**, interfere with uninstallation, and carry out credential theft through overlays, keylogging, cookie theft, lock grabbing, and **SMS interception**. In the newer activity, operators used a **multi-stage infection chain** with a dropper designed to bypass Android 13+ restrictions before installing the final payload under the pretense of reinstalling the app. Earlier analysis also found the malware communicating with a command-and-control server at `146.70.41.143:7242` and exfiltrating device details, cookies, keylogs, and SMS data, while retaining an unused runtime payload-loading capability via `DexClassLoader`, indicating continued development beyond its already mature banking trojan features.
Aug 15, 2026
Security researchers reported a sophisticated iPhone exploitation framework dubbed **Coruna** that appears to have originated as a professionally developed, likely government-grade capability and later proliferated to foreign espionage and criminal actors. Analyses cited by Google’s Threat Intelligence Group and mobile security firm iVerify describe **five exploit chains** spanning **20+ vulnerabilities** affecting **iOS 13 through 17.2.1**, enabling delivery via malicious web content for device fingerprinting, remote code execution, and bypass of key iOS mitigations; the tool’s apparent usage trail includes alleged deployment by **Russian intelligence against Ukrainian targets** and subsequent adoption by a cybercrime group for cryptocurrency theft. Separate mobile-threat reporting detailed multiple **Android** campaigns and families emphasizing stealth, persistence, and credential theft. CloudSEK described a **RedAlert** trojanized app impersonating Israel’s Home Front Command alerting application, using a **multi-stage APK/DEX loader chain** (including an `assets/` payload) and UI mimicry while coercing high-risk permissions (e.g., Contacts, SMS, Location) and establishing C2. PolySwarm summarized **PromptSpy**, an Android RAT with VNC-based remote control that integrates **Google Gemini** to generate context-aware UI gesture instructions from screen XML dumps to improve persistence across device variants, distributed via a phishing site impersonating a bank portal and assessed as financially motivated (notably targeting Argentina). Zimperium separately profiled **ZeroDayRAT** as a modular Android spyware platform spread via social engineering and sideloading, supporting surveillance and financial theft (e.g., screen capture, keylogging, credential harvesting), underscoring continued escalation in mobile malware sophistication.
Jun 29, 2026
ThreatFabric researchers reported a new Android malware strain, **Manic**, that is being actively distributed in the wild and primarily targets users in Ukraine while also reaching victims across Europe and beyond. The malware combines mobile banking trojan behavior with spyware and remote-control functions, targeting at least **169 applications** tied to banks, government and eID services, payment platforms, cryptocurrency wallets, messaging tools, authenticator apps, and military-focused communications. Reported targets include Ukrainian banks and state services, as well as Russian and European financial institutions and global fintech and crypto services. Manic abuses Android **Accessibility** services and uses transparent keypad overlays to capture credentials and user input while legitimate apps continue to operate, enabling theft of PINs, passwords, SMS codes, and other sensitive data. Researchers said the malware also features an unusual fallback exfiltration method that sends encrypted stolen data through nearby infected devices over **Wi-Fi Direct** or **Bluetooth**, including multi-hop routing when a device lacks direct internet access. The campaign has reportedly been active since at least February, with wrapper-based payload delivery observed in late May and more advanced anti-analysis and in-memory DEX loading added in July.
Aug 21, 2026