Coper / Octo - A Conductor for Mobile Mayhem… With Eight Limbs? | Team Cymru

Coper, a descendant of the Exobot malware family, was first observed in the wild in July 2021, targeting Colombian Android users. At that time, Coper (the Spanish translation of “Copper”) was distributed as a fake version of Bancolombia’s “Personas'' application.

The malware offers a variety of advanced features, including keylogging, interception of SMS messages and push notifications, and control over the device's screen. It employs various injects to steal sensitive information, such as passwords and login credentials, by displaying fake screens or overlays. Additionally, it utilizes VNC (Virtual Network Computing) for remote access to devices, enhancing its surveillance capabilities.

#Android #MAS #Exobot #Keylogging #Malware #RemoteAccess #SMS #Coper #Octo

Attacking Android

"In this comprehensive guide, we delve into the world of Android security from an offensive perspective, shedding light on the various techniques and methodologies used by attackers to compromise Android devices and infiltrate their sensitive data. From exploiting common coding flaws to leveraging sophisticated social engineering tactics, we explore the full spectrum of attack surfaces present in Android environments."

#Android #Infosec #Vulnerabilities

AutoSpill: Zero Effort Credential Stealing from Mobile Password Managers

We will present a novel attack - that we call AutoSpill - to steal users' saved credentials from PMs during an autofill operation on a login page loaded inside an app. AutoSpill violates Android's secure autofill process. We found that the majority of top Android PMs were vulnerable to AutoSpill; even without JavaScript injections. With #JavaScriptInjections enabled, all of them were found vulnerable. We discovered the fundamental reasons for AutoSpill and will propose systematic countermeasures to fix AutoSpill properly. We responsibly disclosed our findings to the affected PMs and Android security team. Different PMs and Google accepted our work as a valid issue.

By: Ankit Gangwal , Shubham Singh , Abhijeet Srivastava

Full Abstract and Presentation Materials

#Android #Vulnerabilities #PasswordManager #AutoSpill

Universal Android Debloater Next Generation

Cross-platform GUI written in Rust using ADB to debloat non-rooted #Android devices. Improve your privacy, the security and battery life of your device.

https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation

This is a detached fork of the UAD project, which aims to improve privacy and battery performance by removing unnecessary and obscure system apps. This can also contribute to improving security by reducing the attack surface.

Wiki
https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/wiki

Download
https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/releases

#debloater #uadng

KernelSU

A kernel-based #root solution for #Android

https://kernelsu.org/guide/installation.html

https://github.com/tiann/KernelSU

@KernelSU
@KernelSU_group

Android Malware Vultur Expands Its Wingspan | NCC Group Research Blog

The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim’s mobile device.

Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are decrypted on the fly, and using the guise of legitimate applications to carry out its malicious actions.

Via @androidMalware
#Android #Malware #Vultur

UpgradeAll

Check updates for Android apps, Magisk modules and more

Free and open source software which simplifies the process of finding updates for Android apps (even if you didn't install them), Magisk modules and more. The main focus is on speed and ease of use, which is widely appreciated by users.

Currently, the following sources are officially supported:
Github
Gitlab
F-Droid
Play Store
Coolapk
Source List

https://github.com/DUpdateSystem/UpgradeAll

Telegram channel: https://t.me/upallci
Discussions:
https://t.me/DUpdateSystem
https://matrix.to/#/#upgradeall:matrix.org
https://jq.qq.com/?_wv=1027&k=ZAOtKhuH

Download
https://github.com/DUpdateSystem/UpgradeAll/releases
https://f-droid.org/packages/net.xzos.upgradeall/

#apk #android #upgrade #update

Playing Possum: What's the Wpeeper Backdoor Up To? | XLab_qianxin

On April 18, 2024, XLab's threat hunting system detected an ELF file with zero detections on VirusTotal being distributed through two different domains. One of the domains was marked as malicious by three security firms, while the other was recently registered and had no detections, drawing our attention. Upon analysis, we confirmed that this ELF was malware targeting Android systems, utilizing compromised WordPress sites as relay C2 servers, and we named it Wpeeper.

Wpeeper is a typical backdoor Trojan for Android systems, supporting functions such as collecting sensitive device information, managing files and directories, uploading and downloading, and executing commands.

Via @androidmalware
#Android #Trojan #Possum #Wpeeper
#WordPress