Loading story…
Researchers tied multiple Android threats to the Ztorg malware family, including trojanized apps such as "Cool Video Player," "Magic browser," and "Noise Detector". The malware used anti-analysis checks to avoid Android SDK emulators and common sandbox environments, then contacted command-and-control servers including bbs.tihalf.com and alla.tihalf.com with encrypted device data. In one infection chain, the app decrypted server responses, downloaded a secondary APK, decoded it, stored it as dba.jar, and loaded it invisibly with DexClassLoader, confirming a staged delivery model designed to hide malicious behavior from users and analysts.
Separate Ztorg-linked samples distributed through Google Play were installed more than 60,000 times before removal and shifted monetization from rooting toward premium SMS fraud and likely WAP billing abuse, using IMSI-derived carrier data to tailor activity by country and operator. Other Ztorg payloads went further by lowering SELinux protections, attempting to root devices, replacing system binaries such as /system/bin/debuggerd, and silently installing additional apps and executables for persistence. Analysts said the family combined obfuscation, encrypted payload delivery, rooting components, and stealthy monetization modules, making infections difficult to detect and remove.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The malicious Android app "Magic browser," later linked to a Ztorg Trojan-SMS campaign, was uploaded to Google Play. It was subsequently installed more than 50,000 times before removal.
Fortinet reported that the Android/Ztorg.AM!tr sample it analyzed was detected on January 20, 2017. The sample masqueraded as "Cool Video Player" and acted as a first-stage downloader.
Two malicious Google Play apps, "Magic browser" and "Noise Detector," were distributed as Trojan-SMS.AndroidOS.Ztorg.a. Together they amassed more than 60,000 installs and were used for premium SMS fraud, SMS deletion, and likely WAP billing abuse.
The Ztorg, also known as Qysly, Android malware family first appeared. Later 2017 samples analyzed by Fortinet were identified as variants of this family.
After the malware was reported, Google removed the malicious "Magic browser" and "Noise Detector" apps from Google Play. The apps had been used to distribute Ztorg-linked SMS fraud malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourceblog.fortinet.com
Open sourceblog.fortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Triada**, a modular Android Trojan that gains unauthorized root privileges through an ecosystem of rooting malware and ad-fraud botnets, then embeds itself in system application directories to survive reboots and evade removal. The malware downloads additional modules directly into memory, collects device identifiers and installed-app data, and communicates with hard-coded command-and-control servers while storing encrypted configuration data locally. Triada’s most notable capability is patching Android’s **Zygote** process so its code is injected into nearly every app launched on an infected device, giving it broad visibility and control across the system. Operators used that access to monetize infections through **SMS fraud**, intercepting and altering outgoing messages tied to in-app payments so charges were redirected to attacker-controlled numbers, while filtering incoming SMS and hiding malicious packages, processes, and services from users and security tools.
Aug 14, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026