Context
An Android app spread across Nepal as APK links in messaging apps. Victims who installed it lost control of their phones, and the campaign was linked to money taken from bank accounts.
Approach
- 1Reverse-engineered the APK to map how it was delivered and installed
- 2Traced how it abused Android's accessibility permission to take over the phone and grant itself further permissions
- 3Documented what it could reach (contacts, recordings, calls, saved passwords) and the indicators of compromise
- 4Briefed national tech media so the public could recognise and avoid it
Outcome
The analysis was published by CryptoGen Nepal and covered by TechPana and Techmandu. Police later arrested eight people linked to the campaign.