Threat Intelligence Directory

Triada is a remote access trojan (RAT) malware that is used to compromise Android devices in order to steal confidential and sensitive information such as credit card numbers, passwords, bank account information, etc. It also provides a backdoor for attackers to include the device as part of a botnet and perform other malicious activities.

ToxicPanda is an Android banking RAT first identified by Cleafy in October 2024. It shows similarity to the TgToxic campaign, but appears to be a new development rather than a derivative. The threat actors are likely Chinese speakers. ToxicPanda initially made use of hardcoded C2 domains only, but started to incorporate a DGA in late 2024.

Malware family identifying apk.titan. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.tinyz. Origin and technical characteristics tracked via Malpedia.

According to Trend Micro, this malware appears to have been designed to steal credentials associated with membership websites of major Japanese telecommunication services.

Malware family identifying apk.thiefbot. Origin and technical characteristics tracked via Malpedia.

According to Trend Micro, TgToxic has been used in an ongoing campaign that has been targeting Android users in Southeast Asia since July 2022. Goal of the campaign is to steal victims’ assets from finance and banking applications (such as cryptocurrency wallets, credentials for official bank apps on mobile, and money in deposit), via a banking trojan they named TgToxic (based on its special encrypted filename) embedded in multiple fake apps. While previously targeting users in Taiwan, Trend Micro observed the fraudulent activities and phishing lures targeting users from Thailand and Indonesia as of this writing. Users are advised to be wary of opening embedded links from unknown email and message senders, and to avoid downloading apps from third party platforms.

Tempting cedar spyware is an Android spyware campaign, active since at least 2015, that used social engineering via fake, attractive Facebook profiles to trick victims into downloading malware. The spyware was designed to steal a wide range of sensitive personal data.

Malware family identifying apk.telerat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.tangle_bot. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.talent_rat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.switcher. Origin and technical characteristics tracked via Malpedia.

Svpeng is a malicious banking trojan targeting Android devices, and it poses a significant threat to both mobile users and the developers of mobile banking apps. Svpeng has been active since around 2013. It primarily targets Android users, and its main objective is to steal sensitive financial information, particularly login credentials and personal data related to banking and financial apps. Svpeng typically spreads through malicious apps, phishing campaigns, or drive-by downloads.

According to ThreatFabric, Sturnus is a privately operated Android banking trojan. This malware supports a broad range of fraud-related capabilities, including full device takeover. A key differentiator is its ability to bypass encrypted messaging. By capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal. The trojan can harvest banking credentials through convincing fake login screens that replicate legitimate banking apps. In addition, it provides attackers with extensive remote control, enabling them to observe all user activity, inject text without physical interaction, and even black out the device screen while executing fraudulent transactions in the background—without the victim’s knowledge.

Malware family identifying apk.stealthmango. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.stealthagent. Origin and technical characteristics tracked via Malpedia.

According to Cleafy, SpyNote abuses Accessibility services and other Android permissions in order to: Collect SMS messages and contacts list; Record audio and screen; Perform keylogging activities; Bypass 2FA; Track GPS locations.

SpyMax is a popular Android surveillance tool. Its predecessor, SpyNote, was one of the most widely used spyware frameworks.

A sophisticated mobile surveillance implant operating as a Remote Control System (RCS). This malware family is characterized by a unique, multi-sided communication architecture that abandons traditional HTTP polling. Instead, it hybridizes Firebase Cloud Messaging (FCM) for asynchronous command signaling with Fast Reverse Proxy (FRP) to establish persistent, NAT-bypassing network tunnels, effectively turning the infected mobile device into a server accessible by the attacker.

Malware family identifying apk.spyc23. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.spybanker. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.sova. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.soumnibot. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.smsspy. Origin and technical characteristics tracked via Malpedia.

SMSAgent appears as a game application, but silently performs malicious routines in the background. It attempts to download other potentially malicious files from a remote server and sends out SMS or MMS messages that places expensive charges on the user's bill.

Slocker also known as jisut and pigetrl, is a screen locker that is distributed through telegram groups.

Malware family identifying apk.slempo. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.skygofree. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.silkbean. Origin and technical characteristics tracked via Malpedia.

SideWinder involved a fake VPN app for Android devices published on Google Play Store along with a custom tool that filters victims for better targeting.

Shopper/LeifAccess is a malicious Android app that uses Android's AccessibilityService to secretly control the device. It installs apps, leaves fake reviews, opens ads, and even registers users on various platforms. Disguised as a system app, it collects personal and device information and sends it to remote servers. The malware was most active in late 2019, especially in Russia, Brazil, and India.

SharkBot is a piece of malicious software targeting Android Operating Systems (OSes). It is designed to obtain and misuse financial data by redirecting and stealthily initiating money transfers. SharkBot is particularly active in Europe (United Kingdom, Italy, etc.), but its activity has also been detected in the United States.

An Android ransomware that locks the device, changes the wallpaper, and demands money in exchange for unlocking the phone.

According to ANY.RUN, this is a banking trojan that this collection sensitive user information, including: Registered mobile number, Aadhaar number, PAN card details, Date of birth, and Net banking user ID and password. It uses Telegram as C2.

Malware family identifying apk.rootnik. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.rogue. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.roaming_mantis. Origin and technical characteristics tracked via Malpedia.

Malware family identifying apk.riltok. Origin and technical characteristics tracked via Malpedia.

According to PCrisk, Revive is the name of a banking Trojan targeting Android users (customers of a specific Spanish bank). It steals sensitive information. Cybercriminals use Revive to take ownership of online accounts using stolen login credentials. This malware abuses Accessibility Services to perform malicious activities.

The Android app using for Retefe is a SMS stealer, used to forward mTAN codes to the threat actor. Further is a bank logo added to the specific Android app to trick users into thinking this is a legitimate app. Moreover, if the victim is not a real victim, the link to download the APK is not the malicious APK, but the real 'Signal Private Messenger' tool, hence the victim's phone doesn't get infected.