DomainToolsA new #SpyNote report is out! ๐จ Dive into the tactics of this Android RAT campaign, from dynamic payload decryption to new obfuscation methods. Learn how threat actors are using deceptive Google Play Store clones to target users:
ANY.RUN๐ค Android devices can be a major cybersecurity hazard for businesses. See how #ANYRUN helps detect #malicious files early, accelerate investigations, and improve threat response.
Analysis of #SalvadorStealer and #SpyNote inside๐
https://any.run/cybersecurity-blog/how-android-malware-targets-businesses/?utm_source=mastodon&utm_medium=post&utm_campaign=android_targets_business&utm_term=160725&utm_content=linktoblog
SecuritySnacks๐จ Newly Registered Domains Distributing SpyNote Malware
The latest DomainTools Investigations (DTI) analysis reveals that deceptive websites hosted on newly registered domains are being used to deliver the potent AndroidOS SpyNote malware. These sites mimic the Google Chrome install page on the Google Play Store to lure victims into downloading SpyNote, a powerful Android remote access trojan (RAT) used for surveillance, data exfiltration, and remote control.
๐ Key Findings:
๐ทDeceptive Techniques: Websites mimic popular app installation pages to trick users.
๐ทDomain Patterns: Common patterns in domain registration and website structure.
๐ทLanguage Indicators: Mix of English and Chinese-language delivery sites.
๐ทMalware Capabilities: Extensive surveillance, data theft, and remote control functionalities.
SpyNote's sophisticated capabilities make it a significant threat to individuals and organizations. It can steal sensitive data, activate cameras and microphones, manipulate calls, and even remotely wipe or lock devices. The malware's persistence often requires a factory reset for complete removal.
Check out the full analysis here: https://dti.domaintools.com/newly-registered-domains-distributing-spynote-malware/?utm_source=Mastodon&utm_medium=Social&utm_campaign=SpyNote-GooglePlayStore
#SpyNote #Malware #ThreatIntelligence #CyberSecurity #InfoSec
Newly Registered Domains Distributing SpyNote Malware - DomainTools Investigations | DTI
Deceptive websites hosted on newly registered domains are being used to deliver AndroidOS SpyNote malware. These sites mimic the Google Chrome install page on the Google Play Store.
D3Lab๐ Campagne #Malware in Italia - Week 49
๐ #APK Bank
๐ต๏ธโโ๏ธ #SpyNote / #Antidot / #Irata / #DroidBot / #SmSSpy
โ๏ธ Email Campaigns
๐ผ #Formbook: Preventivo
๐ฆ #AgentTesla: Spedizione
๐ #Remcos: Fattura
๐ฐ #GuLoader: Pagamento
๐งพ #XWorm: Fattura
๐ #SnakeKeyLogger: Bonifico
๐ #Lokibot: Prezzo
ยฉ๏ธ #Rhadamanthys: Copyright
๐ #VipKeyLoggerL: Documento
๐ข Resta vigile! ๐จ
๐ข Campagne #Malware in Italia โ Week 48
๐ Minacce rilevate:
#Formbook โ ๐ฐ Prezzi e Ordini
#SpyNote / #Irata โ ๐ฑ APK Bank
#SnakeKeyLogger โ ๐ค Acquisti
#AsyncRAT โ โ๏ธโ๐ฅ Copyright
#XWorm โ ๐งพ Fattura
#VipKeyLogger โ ๐ Offerta
#AgentTesla โ ๐ Spedizione
๐ข Campagne #Malware in Italia โ Week 47
๐ Minacce rilevate:
#SpyNote / #Irata โ ๐ฑ APK Bank
#Remcos โ ๐ณ Pagamento Bancario
#XWorm โ ๐งพ Fattura
#VipKeyLogger โ ๐ Offerta
#SnakeKeyLogger โ ๐ฆ Ordine
#Vidar โ ๐ฉ Fattura via PEC
#Formbook โ ๐ฐ Prezzi
#AgentTesla โ ๐ Spedizione
#Lumma โ โ๏ธ Copyright
Campagne #Malware #Italy Week 41
โ ๏ธ๐ฅ๐ฃ๐ป
#SpyNote: APK Bank
#Formbook: Estratto Conto
#SnakeKeyLogger: Pagamento Swife
#AgentTesla: Booking
#Remcos: Richiesta Prezzi
#XWorm: Fattura Google
๐จ Nuova campagna di phishing bancario diffonde il #malware Android #EagleSpy!
Questa minaccia, simile a #CraxsRAT e #SpyNote, ruba dati sensibili dai dispositivi Android.
Scopri di piรน e proteggi il tuo smartphone!
๐ https://www.d3lab.net/nuova-campagna-di-phishing-diffonde-malware-android-eaglespy/
Nuova Campagna di Phishing diffonde malware Android EagleSpy
Una recente campagna di phishing sta diffondendo il malware Android EagleSpy, un potente RAT in grado di rubare dati sensibili attraverso false app bancarie. Analizziamo le somiglianze tecniche con SpyNote e CraxsRAT, rivelando le sofisticate tecniche di offuscamento e il coinvolgimento dello stesso
Campagne #Malware #Italy Week 31
๐ป๐ฅ๐ฃโ ๏ธ
#SmokeLoader: Preventivo
#RemcosRAT: Pagamento Bancario
#AgentTesla: Etratto Conto
#Formbook: Ordine
#AsyncRAT: Fattura
#StrRAT: Delivery
#SpyNote - #BingoMod: Malware APK
