Albiriox Exposed A New RAT Mobile Malware Targeting Global F...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.cleafy.com/cleafy-labs/albiriox-rat-mobile-malware-targeting-global-finance-and-crypto-wallets
• Blog Title: Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new subsection on Accessibility-based RAT/ODF techniques and two-stage droppers with overlays & FLAG_SECURE bypass)

🎯 Content Summary

Overview & threat model
Albiriox is a newly identified Android Remote Access Trojan (RAT) and banking malware promoted as a Malware-as-a-Service (MaaS). First seen in September 2025 in a private Telegram beta and then publicly advertised on Russian-speaking cybercrime forums in October 2025, it is explicitly designed for On-Device Fraud (ODF): threat actors (TAs) remotely drive the victim’s legitimate banking/crypto apps from the compromised device, bypassing traditional ser...

🔧 Technical Details

Two‑stage Android dropper chain with JSONPacker and fake system update
The attack uses a first‑stage decoy APK (e.g., com.example.myapplication “PENNY”) distributed via fake Google Play pages and promotions hosted on attacker domains. This dropper is packed with JSONPacker so the real malware code is only unpacked at runtime. On first launch it shows a fake System Update UI to pressure the user into granting the “Install Unknown Apps” permission. After this permission is granted, the dropper sideloads the second‑stage payload APK (e.g., com.nmz.nmz) from attacker infrastructure, installing the actual RAT while static detectors mostly see only the obfuscated dropper.

Phishing infrastructure with geo‑filtered phone validation and Telegram exfiltration
The phishing kit implements a multi‑step lure (select provider → spin “wheel” → enter phone number) instead of direct APK downloads. Client‑side JavaScript (e.g., an 🤖 Agent Actions

Summary:

• Expanded android-app-pentesting/accessibility-services-abuse.md with a detailed Albiriox case study covering its geo-targeted dropper chain (JSONPacker-protected PENNY app, fake system update flow, AppInfos targeting list), dual AC VNC/VNC streaming to bypass FLAG_SECURE, JSON-over-TCP command set for ODF automation, overlay-driven concealment, and Golden Crypt builder-based evasion techniques.
• Updated the References section to include the Cleafy Albiriox research source.

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.cleafy.com/cleafy-labs/albiriox-rat-mobile-malware-targeting-global-finance-and-crypto-wallets

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new subsection on Accessibility-based RAT/ODF techniques and two-stage droppers with overlays & FLAG_SECURE bypass)".

Repository Maintenance:

• MD Files Formatting: 913 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0