Loading story…
Researchers reported that Octagon, an Android malware-as-a-service tool, is being used to hijack banking and cryptocurrency accounts by abusing Android accessibility services, overlay screens, and remote-control features. Identified by iVerify in June 2026, the malware was advertised on a Russian-language cybercrime forum by a seller using the handle AndroidKitKat for $1,400 per month. Octagon can steal credentials, wallet recovery phrases, screenshots, PINs, passwords, and SMS one-time codes, giving operators the ability to bypass multi-factor authentication and take over financial and messaging accounts.
Observed activity links Octagon to Android packages including com.kisa.octagonpanel, a Windows-based operator panel, and infrastructure that includes config.json, TCP port 4444, suspicious delivery or control URLs, and multiple IP addresses and file hashes. Researchers also tied the malware to themed APK lures, including a Lifted Dreams build and a Bahrain-themed campaign that used fake government and Google Play pages with a four-stage APK infection chain. The operation primarily targets wallets, exchanges, banking apps, and messaging platforms, with impersonation templates seen for Trust Wallet, Binance, and MEXC, while relying on sideloading and user-approved accessibility permissions to evade user suspicion and operate despite Play Protect showing no harmful apps.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
In June 2026, iVerify identified the Octagon Android malware and linked it to related APK samples sharing the package name com.kisa.octagonpanel, a default C2 key, and encrypted control traffic over TCP port 4444. Researchers also connected the malware to Lifted Dreams-themed and Bahrain-themed lures used to steal credentials, wallet phrases, and SMS one-time codes.
A Russian-speaking seller using the handle AndroidKitKat advertised the Octagon Android malware-as-a-service offering on a Russian-language cybercrime forum for $1,400 per month. The malware was positioned as a tool for account takeover and financial fraud.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight evolving **Android** threats that abuse SMS/telephony access and advanced evasion to enable fraud, surveillance, and account takeover. CloudSEK described a shift from repackaged apps to **runtime manipulation** using the *LSPosed* framework, where a malicious module (e.g., **Digital Lutera**) hooks `SmsManager` and `TelephonyManager` to undermine India’s **UPI SIM-binding** controls. The technique can intercept registration tokens and 2FA, spoof device identity/phone number, and exfiltrate data to **Telegram**; it also uses **Socket.IO** for real-time C2 and can remotely inject fabricated SMS entries into the device’s “Sent” database to make bank backends believe a SIM is present on a different device, enabling scalable payment fraud and account takeover. Separately, Acronis TRU (reported by Hackread) identified a **fake Red Alert** rocket-warning app distributed via SMS lures impersonating Israel’s Home Front Command; the trojanized app displays legitimate alerts to reduce suspicion while requesting extensive permissions to steal **GPS location**, **SMS/OTP**, contacts, installed-app inventory, and on-device account details, then exfiltrates data to a remote server, including via **certificate spoofing** and UI tricks to appear Play Store-installed. Zimperium reported a new Android RAT, **SurxRAT**, that can download and run **LLM modules** from third-party repositories to automate phishing and social engineering and to interact with apps/UI for credential theft and data exfiltration, reinforcing the need for behavior-based mobile detection, tighter app controls, and stronger integrity enforcement (e.g., *Play Integrity API* with `MEETS_STRONG_INTEGRITY`) where applicable.
Jun 29, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Researchers and Italy’s CERT-AGID reported that the Android banking trojan **Oscorp**, later tracked as **UBEL**, was distributed through a malicious APK site in Italy and evolved into a broader global campaign targeting more than 150 applications, including banking apps. The malware abused Android’s **Accessibility Service** to gain extensive control over infected devices, repeatedly coercing victims to grant accessibility, usage statistics, battery optimization exemptions, and sometimes device administrator privileges to maintain persistence and expand access. Once active, UBEL/Oscorp could steal credentials through phishing overlays rendered in a `WebView`, intercept SMS messages, place calls, trigger call forwarding, execute USSD requests, launch or remove apps, and block legitimate applications. Analysts also documented screen and audio capture via **WebRTC/STUN**, HTTP POST communications with command-and-control servers, and specialized theft functions including replacement of cryptocurrency wallet addresses and harvesting of Google Authenticator one-time codes; published indicators included malware hashes, package names, C2 domains, injection paths, and AES keys tied to the operation.
Aug 15, 2026