Loading story…
An Android spyware campaign targeted Korean-speaking users through phishing pages impersonating Woori Bank and promoting fraudulent loan offers. Victims were prompted to install a fake version of the bank’s WON app, which abused Android Accessibility Service to obtain broad permissions and harvest sensitive data, including contacts, SMS messages, call logs, audio, video, GPS location, installed app lists, screen text, and information entered into embedded fake web pages.
The malware used layered evasion and persistence techniques to hinder analysis and maintain access on infected devices. Researchers reported packed and obfuscated components, encrypted secondary DEX payloads, anti-sandbox checks, and encrypted command-and-control communications, with one server address retrieved through GitHub. The spyware also monitored device events such as BOOT_COMPLETED and outgoing calls, reflecting a financially themed mobile espionage operation that combined social engineering with native Android abuse and obfuscated code to sustain surveillance of South Korean victims.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Cyble analyzed a phishing campaign targeting Korean-speaking users that distributed an Android spyware app masquerading as Woori Bank’s WON app. The malware used packing, encrypted secondary DEX payloads, Accessibility abuse, and fake web pages to steal personal and device data from victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
blog.cyble.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported **RedWing**, a newly identified Android spyware and malware-as-a-service operation marketed through Telegram and distributed via sideloaded apps and mobile phishing pages. The service packages custom droppers, fake app-store lures, phishing templates, operator guides, and subscription tiers that lower the barrier for bank-fraud actors. Investigators said the campaign heavily targets financial institutions—especially Russian banks and crypto services—and currently includes targeting for **82 institutions** across multiple sectors, with infrastructure and tradecraft suggesting a strong Russian-market orientation. Once installed and granted permissions, RedWing gives operators extensive control over infected devices by abusing Android **Accessibility Services**, overlay permissions, default SMS handler privileges, and **MediaProjection**. The malware can harvest credentials and one-time codes, intercept SMS, enable call forwarding, stream the screen, log keystrokes, capture audio and camera feeds, and access files, contacts, call logs, and location, allowing it to bypass SMS- and voice-based 2FA. Researchers also found similarities to the **Oblivion** malware family and said RedWing can dynamically update targeted apps and phishing overlays from its command-and-control panel without requiring a new malware build.
Aug 11, 2026
Check Point Research detailed **FakeCalls**, an Android banking trojan targeting South Korean users by impersonating more than 20 financial applications and tricking victims into believing they are speaking with legitimate bank representatives. The malware is designed to steal private and financial information while exploiting South Korea’s established voice-phishing ecosystem, turning infected devices into tools for social engineering as well as credential and data theft. Researchers identified more than **2,500** FakeCalls samples and found that the malware also supports payload delivery, live audio and video streaming from compromised phones, and concealed command-and-control discovery through **Google Drive** and other dead-drop resolvers. The report also documented three unusual anti-analysis techniques in the APK structure and contents that complicate reverse engineering, underscoring the malware’s sophistication and the risk that its tradecraft could be adapted for campaigns beyond South Korea.
Aug 14, 2026
SpyNote, also tracked as **SpyMax** and commercialized in some cases as **CypherRat**, has evolved from Android surveillance malware into a broad financial-theft platform targeting banking and cryptocurrency users through fake apps and social-engineering lures. Researchers linked a major rise in infections to the public leak of CypherRat source code, which enabled multiple actors to rapidly build custom variants impersonating banks, Google Play, WhatsApp, Facebook, and other trusted brands. Across campaigns, the malware abuses Android **Accessibility Services** to automate installation and updates, resist removal, keylog victims, intercept SMS messages and calls, steal banking credentials, capture Google Authenticator codes, and monitor audio, video, screen activity, and location. Later samples showed SpyNote operators refining both monetization and evasion. Fortinet reported a crypto-wallet-themed variant that overlaid legitimate wallet apps, replaced destination addresses with attacker-controlled ones, and automated fund transfers, while another sample disguised as an OnlyFans app used a dropper to install a second APK and bypass Android 13 **Restricted Settings** through a session-based `PackageInstaller` flow. Regional campaigns in India used fake **IRCTC** and “Wedding Invitation” APKs spread via WhatsApp to steal OTPs, clipboard data, notifications, contacts, and banking information, with researchers also noting malformed APK structures, packing, anti-emulation checks, and compressed command-and-control traffic designed to frustrate reverse engineering and prolong infections.
Aug 15, 2026