Cybersecurity researchers have uncovered a sophisticated Android malware operation called AntiDot that has infected over 3,775 devices across 273 unique campaigns. The malware, operated by the financially motivated threat group LARVA-398, is being sold as Malware-as-a-Service (MaaS) on underground forums.
## AntiDot’s Triple Threat Capabilities
AntiDot markets itself as a “three-in-one” solution offering:
– Screen recording through Android accessibility services abuse
– SMS message interception
– Sensitive data extraction from third-party applications
The malware spreads through malicious advertising networks and targeted phishing campaigns, with attackers selecting victims based on language and geographic location.
## Technical Operations
First documented in May 2024, AntiDot disguises itself as Google Play updates to steal information. The Java-based malware uses commercial packing to avoid detection and operates through a three-stage deployment process:
1. **Initial Installation**: Delivers an APK file with obfuscated code
2. **Permission Exploitation**: Displays fake update prompts to gain accessibility permissions
3. **Full Deployment**: Unpacks and loads botnet functions
Once active, AntiDot monitors for cryptocurrency and payment apps, serving fake login screens when victims access targeted applications. It also hijacks SMS functionality, monitors phone calls, and can block or redirect calls to facilitate fraud.
## Command and Control Infrastructure
PRODAFT researchers identified at least 11 active command-and-control servers managing the infected devices. The control panel, built using MeteorJS framework, features six main functions:
– **Bots**: Lists all compromised devices
– **Injects**: Manages overlay attacks for target apps
– **Analytics**: Tracks installed applications for future targeting
– **Settings**: Core configuration management
– **Gates**: Infrastructure endpoint management
– **Help**: User support resources
## GodFather Banking Trojan Evolution
Separately, researchers discovered an advanced version of the GodFather banking trojan that uses on-device virtualization to hijack legitimate banking and cryptocurrency applications. This sophisticated approach creates isolated virtual environments on victims’ devices, allowing real-time fraud monitoring.
The malware targets nearly 500 applications globally, with current focus on Turkish financial institutions. A particularly concerning feature is its ability to steal device lock credentials regardless of the security method used (pattern, PIN, or password).
## SuperCard X Targets Russian Users
Russian cybersecurity firm F6 reported the first attempts to target Russian users with SuperCard X malware, which conducts near-field communication (NFC) relay attacks for fraudulent transactions. This malware, a malicious modification of the legitimate NFCGate tool, can capture and modify NFC traffic to steal bank card data.
## App Store Infiltration
Malicious applications have also infiltrated official app stores. RapiPlata, a SpyLoan app downloaded approximately 150,000 times on both Android and iOS, targets Colombian users with fake loan offers while stealing extensive personal data including SMS messages, call logs, and calendar events.
Additionally, cryptocurrency wallet phishing apps distributed through compromised developer accounts serve fake pages to steal seed phrases and drain digital assets.
## Security Recommendations
Users should exercise extreme caution when downloading financial or loan-related applications, especially from third-party sources. The evolution of these threats demonstrates the increasing sophistication of mobile malware, requiring proactive defense mechanisms beyond traditional security measures.
The abuse of Android’s accessibility services remains a primary attack vector, highlighting the need for enhanced security protections in mobile operating systems.