Researchers described an Android Trojan (“RatHat”) that starts with scam texts or malicious ads and tricks people into installing a fake app from a bogus download page. After installation, it pressures victims to grant Accessibility permissions using fake excuses or incentives, then uses those privileges to steal banking logins, MFA/OTP codes, and even reconstruct device PINs.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a text: “Update required – download the latest Chrome to keep browsing.” Looks legit, link included. You tap, land on a fake Chrome or streaming-app page that tells you to download an APK. That’s RatHat’s move: smishing you into sideloading a bogus app instead of using Google Play. After install, it pops up: “Enable Accessibility to fix a network restriction and get a reward.” That’s the trap. With Accessibility, RatHat can read your screen, grab banking logins and OTPs, even reconstruct your PIN from touch patterns. Here’s the rule: if a text or ad tells you to install or update an Android app, ignore the link, open Google Play yourself and get it only from there.
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Malwarebytes reports that a multi-stage Windows malware loader called PavinLoader is being delivered through multiple real-world campaigns, including ClickFix “verification” pages and fake software downloads. Victims are tricked into running installers or scripts that use legitimate Windows tools…
Researchers say the Android banking Trojan “Gigabud” can trick victims into installing a fake app, then create a separate Android work profile and run a cloned banking app inside it. Attackers can perform fraudulent transactions from that cloned app, which may reduce the chance that bank defenses…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
