Loading story…
Researchers detailed Trojan.AndroidOS.Loapi, a modular Android malware family spread through advertising campaigns and malicious websites posing as antivirus tools or adult-content apps. Once installed, Loapi aggressively sought device administrator privileges, resisted removal, hid its icon, and could impersonate antivirus activity while connecting to attacker-controlled command-and-control infrastructure for updates and tasking.
Loapi’s modules enabled multiple criminal operations from a single infected device, including ad fraud, premium SMS abuse, WAP billing fraud, web crawling, proxy-based DDoS activity, and Monero mining. The report also found technical and infrastructure links to the older Trojan.AndroidOS.Podec family, indicating likely common operators, and noted that sustained mining and traffic generation physically damaged a test device, causing its battery to bulge after two days.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published an analysis of Trojan.AndroidOS.Loapi, describing its modular Android malware architecture, distribution via malicious ads and websites, persistence mechanisms, and modules for ad fraud, SMS abuse, WAP billing fraud, proxying, DDoS activity, and Monero mining. The report also noted technical and infrastructure overlap with the older Android malware Trojan.AndroidOS.Podec, suggesting a likely common developer group.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale Android malware campaign built around **MiningDropper**, a modular multi-stage framework used to distribute cryptocurrency miners alongside more dangerous payloads including infostealers, banking malware, and remote access trojans. The operation used phishing pages, social media links, and fraudulent websites to trick users into installing malicious APKs disguised as legitimate apps, and was linked to campaigns targeting users in India, Europe, Latin America, and Asia. Investigators observed more than **1,500 samples** in a month, with many showing very low antivirus detection, indicating broad scale and effective evasion. Technical analysis showed the infection chain began with a trojanized version of the open-source **LumoLight** Android project and progressed through staged loaders using XOR-obfuscated native code, AES-encrypted payloads, dynamic DEX loading, split-APK reconstruction, and anti-emulation checks. One analyzed sample, distributed as **`Free Secure – Annulation.apk`**, displayed a fake Google Play update screen before activating a miner path or installing a final payload such as **BTMOB RAT**. The delivered malware enabled credential theft, keylogging, Accessibility abuse, remote device control, audio recording, file management, and financial fraud, underscoring MiningDropper’s role as a reusable malware delivery framework rather than a simple crypto-mining dropper.
Jun 29, 2026
**AntiDot** is being used as an Android banking trojan and malware-as-a-service (**MaaS**) platform that masquerades as fake **Google Play** update apps to trick victims into enabling Accessibility permissions and installing a multi-stage implant. Reporting links the malware to threat actor **LARVA-398** and describes broad, localized targeting through multiple language lures, malicious advertising networks, and some phishing campaigns aimed at users of cryptocurrency, banking, and payment applications. Once installed, AntiDot abuses Accessibility services for overlay attacks, keylogging, SMS theft, notification suppression, contact harvesting, USSD execution, call forwarding, and device locking or unlocking, while also enabling VNC-style remote control through **MediaProjection** and websocket-based command-and-control. Researchers reported at least **11 active C2 servers**, more than **3,775 infected devices**, and at least **273 campaigns**, with the malware using heavy obfuscation, dynamic code loading, backup C2 infrastructure, and a command set that supports app discovery, remote gestures, camera activation, SMS collection, and self-uninstallation.
Aug 15, 2026
Researchers reported that **BTMob** is operating as an Android banking malware and fraud-as-a-service platform that lets multiple criminal actors create branded malicious apps and run large-scale device-takeover campaigns. Analysis of leaked source packages and exposed infrastructure linked the operation to roughly **1,400 live servers**, including command-and-control nodes, an automated APK-building ecosystem, and backend components used to manage victim infections and operator access. The platform is being spread through fake apps, cloned download pages, and social-engineering lures, including WhatsApp messages and phone calls in Brazil that pressure victims to sideload APKs and grant dangerous permissions. Investigators tied the activity to infrastructure using `/yaarsa/` PHP backend paths, HTTP and WebSocket endpoints, a control panel on port `3000` identified by the string **"painel de controle elite"**, and payloads including `lnat-tv-pro.apk`, `BTMob.exe`, `SolrStarter.exe`, and `SolrWorker.exe`, while also linking the operation to the earlier **CraxsRAT** and **SpySolr** malware families.
Aug 22, 2026