Loading story…
Threat actors distributed Android malware disguised as high-profile mobile games, using fake Super Mario Run and Pokémon GO APKs to lure users into sideloading infected apps. In both cases, the packages carried the DroidJack remote access trojan, also known as SandroRAT, allowing attackers to gain extensive control over compromised devices while presenting interfaces that mimicked the legitimate games and exploited demand around their releases.
Once installed, the malware registered infected devices and harvested sensitive data including SMS messages, call logs, call recordings, photos, videos, and WhatsApp content, storing stolen information locally before exfiltrating it to hardcoded command-and-control infrastructure. Proofpoint reported a Pokémon GO-themed sample configured to contact pokemon.no-ip.org over TCP and UDP port 1337, while Zscaler described a Super Mario Run lure that similarly used a hardcoded C2 server, underscoring the risk that third-party Android app downloads can expose both personal and enterprise-connected devices to full-device compromise.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
A malicious Pokémon GO Android APK containing the DroidJack RAT was uploaded to a malicious file repository at 09:19:27 UTC. Proofpoint said the upload occurred less than 72 hours after the game's initial launch in Australia and New Zealand.
Pokémon GO was released in the United States two days after its initial Australia and New Zealand launch.
Pokémon GO was first released in Australia and New Zealand, creating immediate demand for unofficial Android APKs in regions where the game was not yet available.
A malicious Android package posing as Super Mario Run was found to install the DroidJack RAT instead of any legitimate game payload. Once installed, it registered infected devices and harvested data including calls, SMS logs, call logs, videos, photos, and WhatsApp information for exfiltration to a hardcoded command-and-control server.
Proofpoint researchers discovered an Android Pokémon GO APK backdoored with DroidJack, also known as SandroRAT. The sample mimicked the legitimate game's startup screen and was configured to contact pokemon.no-ip.org over TCP and UDP port 1337.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Threat actors used **COVID-19-themed lures** to push Android malware through SMS phishing and unofficial download sites, targeting users with fake alerts, safety tools, and public-health claims. Proofpoint reported that the **TangleBot** campaign sent text messages in the United States and Canada themed around coronavirus information and power outages, directing Android users to links that served a malicious APK and a fake **Adobe Flash Player** update prompt. Separately, researchers documented a fake **"Corona Safety Mask"** app and similar coronavirus-themed Android packages that were distributed outside official app stores and promoted through deceptive websites and messages. Once installed, the malware gave operators extensive access to infected devices. TangleBot supported surveillance and device control features including **keylogging, SMS and call control, screen capture, camera and microphone access, GPS tracking, clipboard access, and overlay injection**, while using obfuscation and Telegram-based command-and-control discovery to hinder analysis. The other Android trojan focused on propagation by requesting permission to read contacts and send SMS messages, harvesting address books and sending malicious texts with download links to additional victims; researchers also warned the app appeared capable of evolving toward broader fraud or theft functions.
Aug 15, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026