Cyble Research and Intelligence Labs uncovered Glitch SPY, an emerging Android malware family distributed through a fake Polish apartment rental website that tricks users into downloading an APK. The platform abuses Android Accessibility Service, maintains WebSocket-based C&C communication, and supports surveillance, clipboard theft, remote browser abuse, and crypto-clipper activity. #GlitchSPY #BrokewellLoader #tutaj-dompl #sportypointsrewards

At a glance Malware family Copybara (Android RAT) Operators Not attributed; kit uses Portuguese-language identifiers Targets N26 banking customers in Italy Delivery vector Vishing call, phishing login page, sideloaded APK Key capabilities Accessibility remote control, keylogging, screen capture, SMS theft, overlays Source D3Lab TL;DR Researchers at D3Lab tracked a live fraud campaign that impersonates the bank N26 in Italy. It starts with a fake support call and ends with a…

BTMOB started as a centrally run Android RAT malware-as-a-service operation, but it has since splintered into a fragmented underground market of resellers, source-code vendors, independent server operators, and impersonators. Flare researchers found that the official channel kept releasing new versions and infrastructure offers while cheaper and sometimes unverified BTMOB listings spread across Telegram and other platforms. #BTMOB #Flare #Telegram

At a glance Malware family Glitch SPY (Android RAT and builder platform) Threat actor Unattributed; operator unidentified Targets People seeking rental properties in Poland; Polish speakers Delivery Fake Polish rental website pushing an APK via the Brokewell loader Key capabilities Screen streaming, keylogging, SMS and contact theft, crypto-clipper, remote browser, remote control Source Cyble Research and Intelligence Labs TL;DR Cyble uncovered a new Android RAT called Glitch SPY.

BTMOB is an Android remote access trojan sold as a malware-as-a-service platform with a builder that lets criminals create customized phishing-based payloads without coding. It targets users mainly in Brazil and Latin America, using fake Google Play pages, Accessibility abuse, and multiple theft and remote-control features. #BTMOB #SpySolr #ESET #ANYRUN #Cyble