Kaspersky: Attackers Manipulate Legitimate Apps

Cybersecurity researchers have uncovered a sophisticated malware campaign targeting users through trojanized legitimate applications, including corporate messengers and delivery services. By injecting malicious payloads into trusted software, attackers bypass standard security filters to exfiltrate sensitive data and monitor user activity on Android and iOS devices globally.

This isn’t your run-of-the-mill phishing attempt. We are witnessing a strategic pivot toward supply-chain poisoning at the edge. When the application you utilize to coordinate a boardroom meeting or order dinner becomes the spy in your pocket, the traditional concept of a “secure perimeter” evaporates. The brilliance—and the terror—of this attack lies in its exploitation of human trust.

For years, the industry has preached the gospel of “only download from official stores.” But this malware proves that the distribution channel is no longer the only point of failure. By manipulating the binary of a legitimate app, attackers are essentially riding a Trojan horse past the gatekeepers.

The Trojan Horse Strategy: Why Trusted Apps are the New Vector

The technical execution here is a masterclass in social engineering paired with binary manipulation. Attackers aren’t building new apps from scratch; they are taking existing, high-traffic binaries—specifically corporate messengers and delivery apps—and “trojanizing” them. This process involves decompiling the original application, injecting a malicious library (often a hidden .so file in Android environments), and resigning the package.

Once the user installs the manipulated version, the app functions exactly as expected. The delivery driver still arrives; the messages still send. This “functional camouflage” ensures the user doesn’t suspect a thing while the malware operates in the background, leveraging system-level permissions that the user had already granted to the legitimate app.

The malware specifically targets the Accessibility Services on Android. While designed to facilitate users with disabilities, these services are a goldmine for attackers. By gaining accessibility permissions, the malware can perform “screen scraping”—reading every character typed, every message received, and every password entered—without needing to trigger a separate, suspicious permission request.

The 30-Second Verdict: What’s Actually at Risk?

• Credential Theft: Real-time interception of 2FA codes and login tokens.
• Corporate Espionage: Full access to encrypted corporate messengers via screen reading.
• Financial Drain: Intercepting payment gateways within delivery and shopping apps.
• Persistent Surveillance: Activation of microphones and cameras via hidden API calls.

Deconstructing the Payload: From Decompilation to Data Exfiltration

Under the hood, the malware employs a sophisticated Command and Control (C2) architecture. Instead of communicating with a known malicious IP, the payload uses Domain Generation Algorithms (DGA) to rotate its connection points, making it nearly impossible for static firewalls to block the traffic. The data is then exfiltrated using HTTPS, blending in perfectly with the app’s legitimate telemetry traffic.

From an engineering perspective, the most alarming aspect is the use of reflective loading. The initial malicious code is a small “dropper” that doesn’t contain the full spying suite. Instead, it reaches out to the C2 server to download the actual payload directly into the device’s RAM. Because the malicious logic never touches the disk as a standalone file, traditional signature-based antivirus software is effectively blind.

“The shift toward memory-resident payloads in mobile malware represents a critical escalation. We are moving away from ‘files’ and toward ‘behaviors,’ which means our detection methods must shift from scanning disks to analyzing real-time API call patterns.”

This approach bypasses the OWASP Mobile Top 10 defenses that many developers rely on. Even apps with strong encryption are vulnerable because the malware captures the data before it is encrypted or after it is decrypted on the screen.

The DMA Dilemma: Open Ecosystems vs. Attack Surfaces

This surge in trojanized apps arrives at a volatile moment for platform architecture. The European Union’s Digital Markets Act (DMA) has pushed Apple and Google toward opening their ecosystems, allowing third-party app stores and easier “side-loading” of applications. While Here’s a victory for competition and developer freedom, it is a nightmare for the security analyst.

By breaking the “walled garden,” we have expanded the attack surface. When users are encouraged to install apps from sources other than the primary App Store or Play Store, the probability of encountering a trojanized binary increases exponentially. We are essentially trading a centralized point of trust for a fragmented landscape of varying security standards.

This creates a dangerous paradox: the more we democratize software distribution, the more we rely on the end-user to be a forensic analyst. Most users cannot check a CVE status or verify a SHA-256 hash before clicking “Install.”

Hardening the Perimeter: Enterprise Mitigation Strategies

For the average user, the advice is simple: stick to official stores and scrutinize permission requests. But for the enterprise, the stakes are higher. If a single employee installs a compromised messenger app on a BYOD (Bring Your Own Device) phone, the entire corporate network is potentially exposed.

The solution is a transition to a Zero-Trust Architecture for mobile endpoints. This means implementing Runtime Application Self-Protection (RASP), which allows an app to detect if its own binary has been tampered with or if it is running in a compromised environment (like a rooted device or an emulator).

Enterprises should also deploy Mobile Threat Defense (MTD) solutions that monitor for anomalous API behavior. For example, if a delivery app suddenly starts requesting access to the contacts list and the microphone every ten minutes, the MTD should automatically quarantine the device from the corporate VPN.

Defense Layer	Traditional Approach	Zero-Trust / Modern Approach
App Verification	Store-based validation	Binary Hash Verification & RASP
Network Security	VPN / Firewall	mTLS & Micro-segmentation
Threat Detection	Signature-based AV	Behavioral Heuristics & AI-driven EDR
Permissions	User-granted (Static)	Just-in-Time (JIT) Permissions

The reality of 2026 is that the software we trust is the most effective weapon for the adversary. The “trusted app” is no longer a safe harbor; it is the primary vector. As we move forward, the only way to survive this landscape is to assume that every binary is compromised until proven otherwise. Stop trusting the icon. Start verifying the code.

For those seeking deeper technical analysis on binary integrity, the Kaspersky Research archives provide an exhaustive breakdown of the C2 infrastructure used in these specific campaigns.