Loading story…
Version 3.17.18 of the official APKPure Android app was found to contain malicious code that decrypted and launched a payload at startup, turning the third-party app store itself into a malware delivery channel. The payload collected device information, sent it to a command-and-control server, displayed intrusive advertising, opened browser pages with ads, and could fetch additional executable modules for further activity on infected devices.
Researchers observed the app downloading a Trojan resembling Triada, a malware family known for ad fraud, forced subscriptions to paid services, and secondary malware delivery. The exposure was especially serious on older Android versions, where the malware could install apps into the system partition and potentially create persistent, hard-to-remove infections similar to xHelper. APKPure was reportedly notified on April 8 and addressed the issue by releasing version 3.17.19.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
APKPure remediated the incident by releasing version 3.17.19 of its Android app. Users were advised to remove version 3.17.18 and install the clean replacement.
APKPure confirmed that version 3.17.18 of its official Android app was infected with malicious code. The implanted code decrypted and launched a payload that collected device data, contacted a command-and-control server, showed ads, and could fetch additional malware.
The malicious code issue in the official APKPure Android app was reported to APKPure's developers on April 8. This disclosure preceded APKPure's confirmation and remediation of the infected release.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Trojan-Dropper.AndroidOS.Shopper.a** used Android's **AccessibilityService** to take over device interactions, silently grant permissions, disable **Google Play Protect**, and install applications from **Google Play** or **APKPure**. Disguised as a system app named **ConfigAPKs**, the malware collected device details, waited until the screen was unlocked to fetch additional payloads, and contacted the command-and-control domain `api.adsnative123[.]com`. The malware was used to manipulate app-store rankings by inflating installs, registrations, and fraudulent reviews while also displaying ads and creating shortcuts to advertising sites. Infected devices were further abused to register accounts in legitimate apps using victims' **Google** or **Facebook** credentials, with activity reported most heavily in **Russia** during late 2019, followed by **Brazil** and **India**.
Aug 15, 2026
Researchers detailed **Triada**, a modular Android Trojan that gains unauthorized root privileges through an ecosystem of rooting malware and ad-fraud botnets, then embeds itself in system application directories to survive reboots and evade removal. The malware downloads additional modules directly into memory, collects device identifiers and installed-app data, and communicates with hard-coded command-and-control servers while storing encrypted configuration data locally. Triada’s most notable capability is patching Android’s **Zygote** process so its code is injected into nearly every app launched on an infected device, giving it broad visibility and control across the system. Operators used that access to monetize infections through **SMS fraud**, intercepting and altering outgoing messages tied to in-app payments so charges were redirected to attacker-controlled numbers, while filtering incoming SMS and hiding malicious packages, processes, and services from users and security tools.
Aug 14, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026