Loading story…
AntiDot is being used as an Android banking trojan and malware-as-a-service (MaaS) platform that masquerades as fake Google Play update apps to trick victims into enabling Accessibility permissions and installing a multi-stage implant. Reporting links the malware to threat actor LARVA-398 and describes broad, localized targeting through multiple language lures, malicious advertising networks, and some phishing campaigns aimed at users of cryptocurrency, banking, and payment applications.
Once installed, AntiDot abuses Accessibility services for overlay attacks, keylogging, SMS theft, notification suppression, contact harvesting, USSD execution, call forwarding, and device locking or unlocking, while also enabling VNC-style remote control through MediaProjection and websocket-based command-and-control. Researchers reported at least 11 active C2 servers, more than 3,775 infected devices, and at least 273 campaigns, with the malware using heavy obfuscation, dynamic code loading, backup C2 infrastructure, and a command set that supports app discovery, remote gestures, camera activation, SMS collection, and self-uninstallation.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Cyble reported that the Android banking trojan Antidot was initially spotted masquerading as a Google Play update application. The malware used accessibility abuse, overlays, keylogging, remote control, SMS theft, and other capabilities to compromise victims.
Prodaft reported that AntiDot is operated by threat actor LARVA-398 as a malware-as-a-service platform. Its analysis identified at least 11 active C2 servers managing more than 3,775 infected devices across at least 273 campaigns, with targeting focused on cryptocurrency, financial, and payment-related apps.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**TeaBot** (also tracked as **Anatsa**) infected Android devices through smishing campaigns and trojanized apps, including fake media, delivery, and utility software such as VLC, DHL, UPS, TeaTV, and QR-code scanners. Researchers found the malware later reached users through Google Play droppers that displayed fake update prompts and fetched second-stage APKs from GitHub, extending distribution beyond SMS lures. Campaigns initially focused on European banks, especially in Spain, Germany, and Italy, before expanding to roughly 400 targeted applications spanning banking, cryptocurrency, wallet, insurance, and other financial services in additional regions including the United States, Russia, and Hong Kong. Once installed, TeaBot abused Android **Accessibility Services** to gain broad control of the device, then hid its icon, intercepted SMS messages, logged keystrokes, captured screens, enumerated installed apps, and launched overlay attacks to steal credentials and 2FA codes from targeted apps. Analysts said the malware dynamically decrypted and loaded additional payloads, used partially XOR-encrypted command-and-control traffic, and in some cases terminated selected processes, including security tools, to reduce detection. Reports tied some second-stage payload delivery to GitHub repositories and noted that malicious Play Store apps had accumulated significant downloads before being identified and removed.
Aug 15, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Security researchers reported multiple Android malware campaigns that used droppers distributed through **Google Play** to install banking trojans and remote-access malware while evading marketplace defenses. Check Point detailed **Clast82**, a dropper embedded in trojanized utility apps that delayed malicious activity until after publication by checking a Firebase-controlled `enable` flag, then fetched payloads from GitHub and pushed victims to allow installs from unknown sources through repeated fake **Google Play Services** prompts. The campaign delivered **AlienBot Banker** and **MRAT**, relied on fake developer accounts and shared infrastructure, and led to the removal of the identified apps from Google Play. Trend Micro later described **DawDropper** as a similar Android dropper operation that also abused **Firebase Realtime Database** and **GitHub** to dynamically retrieve payloads and avoid detection in apps posing as document scanners, cleaners, and QR scanners. DawDropper was used to distribute banking malware including **Octo**, **Hydra**, **Ermac**, and **TeaBot**; researchers said Octo could steal banking credentials, intercept SMS messages, disable **Google Play Protect**, hijack devices, and use **VNC-based** remote screen control while hiding its activity. The findings also tied these campaigns to a broader underground market for **dropper-as-a-service (DaaS)** offerings, showing how commodity delivery infrastructure was being used to scale Android banking malware distribution.
Aug 14, 2026