MoqHao (aka Wroba) is an Android Remote Access Trojan (RAT) with information-stealing and backdoor capabilities that likely spreads via SMS.

Joker, Facestealers and Banker swarming Google Play store

Update: 10 March 2024 List of open source Android applications for “de-google, de-samsung, de-microsoft, de-nsa, de-china-malware etc. etc.” your mobile phone, as always, the list is written in a KISS simple way. The apps in the list are divided by category…

Authored by Dexter Shin McAfee's Mobile Research Team has identified new malware on the Google Play Store. Most of them are disguising themselves as

This article is part of the Security Tech Blog Series: Spring Cleaning for Security. My name is Azeem Ilyas and I’m part

In this blog post, we discuss the technical details of a new banking dropper that we have dubbed DawDropper, give a brief history of banking trojans released in early 2022 that use malicious droppers, and elaborate on cybercriminal activities related to DaaS…

Previous posts: Basic definitions and registers, lab setup, offset and addressing modes, Load And Store, Branch

Introduction

The messaging app left a huge database of unencrypted private messages online but without a password for months.

Previous posts: Basic definitions and registers, lab setup, offset and addressing modes, Load And Store, Branch, Data Processing Part 1

Threat actors are constantly using new tricks and tactics to target users across the globe. This blog is about SpyNote,  […]

A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Research This is part one of a two-part guest...

SOVA, a new Android Banking Trojan, is spreading across Europe. Already appeared in different versions, this malware is now evolving, and it is targeting more than 200 mobile applications, ranging from banking apps to crypto exchanges/wallets. Here's the…

Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.

In Q2 2022, we detected 405,684 mobile malware installation packages, of which 55,614 packages were related to mobile banking trojans, and 3,821 packages were mobile ransomware trojans.

So far we went trough the most important instructions of the AArch64 instruction set and it is time to move to something more practical. In…

During a Digital Forensics investigation, ZecOps made an interesting finding: a cheap burner device that purported to be an Android 10 was actually an old Android 6. In the first part of the series, we presented how attackers can ‘fake’ the shutdown screen…

Analysis of the group behind Xenomorph and Gymdrop