The Cleafy Threat Intelligence Team has uncovered a large-scale Malware-as-a-Service (MaaS) operation orchestrated by Chinese-speaking Threat Actors. The operation has globally infected over 11,000 An...

A recent report highlights two emerging malware threats with limited technical details disclosed. The first is a malware named "瘟疫" targeting Linux servers, reportedly capable of evading detection by 66 antivirus engines. The second is an Android Trojan called PlayPraetor, which has infected over 1.1 million devices. However, the original article does not provide technical specifics or real-world impacts of these attacks. For cybersecurity professionals, while the available information is sparse, these reports underscore the continuous evolution of malware threats across different platforms. The reported evasion capabilities of the Linux malware and the scale of the Android Trojan infections emphasize the necessity for robust, multi-layered security defenses. In the absence of detailed threat intelligence, organizations should prioritize advanced detection methods, proactive monitoring, and comprehensive security strategies to mitigate potential risks. The lack of specific technical information in the source material limits a more detailed analysis. However, the reported scale and evasion capabilities of these threats serve as a stark reminder of the dynamic and challenging nature of contemporary cybersecurity threats.

Cybersecurity researchers have discovered a nascent Android remote access trojan (RAT) called PlayPraetor that has infected more than 11,000 devices, primarily across Portugal, Spain, France, Morocco, Peru, and Hong Kong. "The botnet's rapid growth, which now exceeds 2,000 new infections per week, is driven by aggressive campaigns focusing on Spanish and French speakers, indicating a strategic shift away from its previous common victim base," Cleafy researchers Simone Mattia, Alessandro Strino, and Federico Valentini said in an analysis of the malware.

Um novo malware de acesso remoto foi descoberto em circulação e já comprometeu mais de 11 mil dispositivos. Chamado de PlayPraetor, o trojan possui estrutura semelhante a outras ferramentas da categoria e tem como objetivo obter controle remoto do dispositivo e roubar credenciais de apps bancários e carteiras digitais. O **PlayPraetor é um Android RAT (Remote Access Trojan) distribuído por meio de links maliciosos enviados via SMS ou por anúncios hospedados no Meta Ads**. O controle do malware é feito por um painel command-and-control (C2) de origem chinesa. * **Leia mais:****Mailchimp sofre vazamento de dados após invasão do grupo de ransomware** "O crescimento da rede de bots, que agora excede a marca de 2 mil infecções por semana, é impulsionado por uma campanha agressiva focada em usuários que falam espanhol e francês, indicando uma mudança de estratégia em relação à base de vítimas anterior", explicaram pesquisadores da empresa de cibersegurança Cleafy. Nova campanha de malware se manifesta em diferentes variantes. (Fonte: Security Affairs, Cleafy) ## Como funciona o malware PlayPraetor? O **PlayPraetor foi identificado pela primeira vez pela empresa CTM360, em março de 2025**. Segundo os pesquisadores, ele era distribuído por meio de milhares de páginas fraudulentas que imitavam a Play Store. "Os links se passam por páginas da Play Store, distribuídos por meio do Meta Ads e mensagens SMS, com o objetivo de alcançar um público amplo. Esses anúncios e mensagens maliciosas convencem o usuário a clicar nos links, direcionando-os a páginas falsas com APKs infectados", detalhou a empresa. Assim como outros malwares, **os criminosos tentam convencer o usuário de que o aplicativo é legítimo**. ### Quais são as cinco variações da campanha de disseminação do PlayPraetor? * Progressive Web App (PWA): web app falso que cria atalhos e envia notificações para atrair interações; * Apps WebView (Phish): app que abre uma página falsa de phishing para roubo de credenciais; * PlayPraetor (Phantom): permite execução persistente de código remoto; * PlayPraetor RAT: trojan completo de acesso remoto; * PlayPraetor Veil: se disfarça como uma marca legítima para aplicar golpes de phishing. ## Quais são os alvos do PlayPraetor? O PlayPraetor mira tanto usuários domésticos quanto corporativos, oferecendo vantagens para os criminosos independentemente do perfil da vítima. Atualmente, **58% dos casos registrados estão concentrados em Portugal, Espanha e França. Marrocos, Peru e Hong Kong também aparecem entre os países mais afetados**. Após sua identificação no sul da Europa e na América Latina, o **PlayPraetor foi considerado uma ameaça cibernética global**. Este malware é mais um exemplo de campanha operada por grupos falantes de chinês voltada à prática de fraudes bancárias. **Outros casos semelhantes incluem o ToxicPanda e o SuperCard X** , ambos identificados em 2024. Quer se proteger contra os malwares mais recentes e manter seus dados seguros? Siga o **TecMundo** nas redes sociais e acompanhe as principais atualizações sobre cibersegurança e tecnologia.

PlayPraetor Android RAT has hit 11K+ devices, spreading fast via campaigns targeting Spanish and French speakers, say Cleafy researchers.

A newly discovered Android remote access trojan (RAT) known as PlayPraetor has rapidly surged across the globe, infecting more than 11,000 devices in countries including Portugal, Spain, France, Morocco, Peru, and Hong Kong. Security researchers have warned that the malware’s reach is expanding at a rate of over 2,000 new infections weekly, driven primarily by aggressive campaigns targeting Spanish- and French-speaking users.

Cybersecurity researchers have discovered a nascent Android remote access trojan (RAT) called PlayPraetor that has infected more than 11,000 devices, primarily across Portugal, Spain, France, Morocco, Peru, and Hong Kong. "The botnet's rapid growth, which now exceeds 2,000 new infections per week, is driven by aggressive campaigns focusing on Spanish and French speakers, indicating a strategic shift away from its previous common victim base," Cleafy researchers Simone Mattia, Alessandro Strino, and Federico Valentini said in an analysis of the malware.

Welcome to this week's Data Breaches Digest, a catalogue of links concerning Data Breaches and Cyber Security that were published on the Internet during the period between 4th August and 10th August 2025. _**4th August**_ Average global data breach cost now $4.44 million Cloud Intrusions Skyrocket in 2025 Non-Human Identities (NHIs) Continue to Outpace Human Identities and Bump Up Security Risk PlayPraetor Android Trojan Infects 11,000+ Devices via Fake Google Play Pages and Meta Ads Tax authority of Curacao expects to be back in business today after ransomware attack The Ransomware Nightmare Gets Worse: “We Know Where Your Kids Live.” The New Frontier of Cybercrime The surprising truth about identity security confidence

Over 6,000 malicious sites are spreading the PlayPraetor Trojan

Visit the link for more information

Un nouveau malware baptisé PlayPraetor cible massivement les smartphones Android, avec une propagation fulgurante qui touche déjà le Royaume et plusieurs pays francophones. Capable de prendre le contr...

A large-scale Malware-as-a-Service (MaaS) campaign operated by Chinese-speaking threat actors has deployed the PlayPraetor Android Remote Access Trojan (RAT) on over 11,000 devices worldwide, using so...

PlayPraetor Android RAT has hit 11K+ devices, spreading fast via campaigns targeting Spanish and French speakers, say Cleafy researchers. Cleafy researchers have identified a new Android RAT called PlayPraetor, which has infected over 11,000 devices, mainly in Portugal, Spain, France, Morocco, Peru, and Hong Kong. The malware is spreading rapidly, with more than 2,000 new […]

Cybersecurity researchers have discovered a nascent Android remote access trojan (RAT) called PlayPraetor that has infected more than 11,000 devices, primarily across Portugal, Spain, France, Morocco, Peru, and Hong Kong. "The botnet's rapid growth, which now exceeds 2,000 new infections per week, is driven by aggressive campaigns focusing on Spanish and French speakers, indicating a strategic

Overview of the PlayPraetor Masquerading Party Variants CTM360 has now identified a much larger extent of the ongoing Play Praetor campaign. What started with 6000+ URLs of a very specific banking attack has now grown to 16,000+ with multiple variants. This research is ongoing, and much more is expected to be discovered in the coming days.  As before, all the newly discovered play

Introduction: The Rise of a New Mobile Menace A dangerous new Android malware named PlayPraetor has been uncovered by cybersecurity firm Cleafy. With over 11,000 confirmed infections and counting, this Remote Access Trojan (RAT) has quickly escalated into a major international threat, targeting users mainly in Portugal, Spain, France, Morocco, Peru, and Hong Kong. Unlike many prior malware campaigns that used brute-force techniques or crude phishing, PlayPraetor introduces a multi-layered, professionally executed strategy — leveraging fake Google Play Store pages, modular attack variants, and a Chinese-language command-and-control (C2) infrastructure to dominate victims' mobile devices.

A Dangerous New Threat in the Android World Cybersecurity experts have sounded the alarm over a stealthy new Android malware dubbed PlayPraetor, which has infected over 11,000 devices globally. Originating from Chinese-speaking threat actors, this sophisticated Remote Access Trojan (RAT) is designed to hijack mobile banking sessions, steal personal data, and maintain deep control over compromised devices. Its spread has been explosive — more than 2,000 new devices are infected each week, with a growing focus on Spanish and French speakers.