Android RAT Impersonates Japanese Brands to Steal Credentials and Enable Remote Control
Malware Intelligence · 2 sources · Updated 27d ago · First seen Oct 17, 2026
Researchers at STAR Labs identified 64 Android malware samples sharing a common dropper that installs a packed, WebSocket-based remote-access Trojan (RAT). The likely financially motivated operation impersonates Japanese financial and government services, as well as investment, romance and entertainment apps. Its web control panels carry either “Black Hawk Android Remote Control” or “Eagle Android Remote” branding, with identical login pages and a shared Chinese-language tagline. Both variants were simultaneously active on October 16, but the evidence does not establish whether separate operators share a builder or one operator uses multiple brands.
The RAT supports lock-screen credential and payment-input theft, screen streaming, accessibility-based remote control, WebView injection and wireless-ADB self-pairing to gain additional privileges. Samples conceal their payloads using either a simple libsa XOR packer or the open-source nmmp virtual-machine protector, while multiple persistence mechanisms help maintain access. Defenders should prioritize stable component and behavioral fingerprints over the widely reused signing certificate, and avoid treating legitimate brand websites used as cover pages as malicious indicators.
