Cybersecurity researchers have uncovered a sophisticated Android malware campaign that utilizes Microsoft’s .NET Multi-platform App UI (.NET MAUI) framework to create convincing fake banking and social media applications. The malware primarily targets users in India and Chinese-speaking regions.

According to McAfee Labs researcher Dexter Shin, these threats effectively disguise themselves as legitimate applications to steal sensitive user information. The malware, codenamed “FakeApp,” includes multiple applications impersonating popular platforms like X (formerly Twitter), financial institutions, and various Chinese-language apps.

## Technical Innovation in Malware Development

What makes this campaign particularly concerning is its technical approach. The malware developers have shifted from the now-deprecated Xamarin framework to Microsoft’s newer .NET MAUI platform, which allows for cross-platform development using C# and XAML.

“These apps have their core functionalities written entirely in C# and stored as blob binaries,” Shin explained. “This means that unlike traditional Android apps, their functionalities do not exist in DEX files or native libraries.”

This implementation provides significant advantages to attackers:
– .NET MAUI effectively functions as a packer, concealing malicious code
– The approach helps evade traditional detection methods
– Malware can persist longer on infected devices

## Distribution and Targeting

Rather than appearing on Google Play, these malicious apps spread through:
– Deceptive links sent via messaging applications
– Redirects to unofficial app stores

The banking variants target Indian users by impersonating financial institutions to collect personal information including:
– Full names and contact details
– Residential addresses
– Credit card numbers
– Government-issued identifiers

Social media impersonation apps primarily target Chinese-speaking users, stealing contacts, SMS messages, and photos.

## Advanced Evasion Techniques

The malware employs several sophisticated methods to avoid detection:
– Encrypted socket communication for data exfiltration
– Inclusion of meaningless permissions in the AndroidManifest.xml file to confuse analysis tools
– Multi-stage dynamic loading with XOR and AES encryption
– Hidden payloads within C# code that activate when users interact with the app

This campaign demonstrates how threat actors continue to adapt their tactics, leveraging modern development frameworks to create more effective and evasive malware.