BeatBanker is an Android Trojan campaign that targets users in Brazil via phishing sites impersonating the Google Play Store to deliver a crypto miner and a banking module (recent samples drop the BTMOB RAT instead). It maintains persistence by looping an almost inaudible audio file, abuses Accessibility and overlay capabilities to intercept USDT transactions, and uses Firebase Cloud Messaging for command-and-control. #BeatBanker #BTMOB

Keenadu, a backdoor found in Android firmware, appears to have been introduced via a malicious static library linked to libandroid_runtime.so during firmware builds and, in other cases, pushed through OTA updates; it acts as a multistage loader enabling remote control, search hijacking, monetized app installs, and stealthy ad interactions. Extensive DNS and WHOIS analysis uncovered 29 primary IoCs (five subdomains, 20 domains, four IPs), dozens of associated email- and IP-connected domains, and additional weaponized IPs—highlighting infrastructure tied to istaticfiles[.]com. #Keenadu #istaticfiles

NoVoice is a new Android threat found in over 50 Google Play apps with at least 2.3 million installs that uses steganography and a suite of exploits to obtain root and install a persistent rootkit. It injects into apps to steal sensitive data—most notably WhatsApp encryption keys and backups—allowing attackers to clone accounts; #NoVoice #WhatsApp

DroidLock malware is a new Android threat that locks phones, steals data, and pressures victims for a ransom.