Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Caught in the Act: Uncovering SpyNote in Unexpected Places

hunt.io | blog | #android | #apk | #spyware | #open-directories | #mobile-malware | #spynote

Summary

Hunt uncovered SpyNote Android spyware samples in open directories, disguised as Google Translate, Temp Mail and Deutsche Postbank apps, detailing how the leaked spyware steals user data.
Published
Collected

original ↗

Related coverage

blog · hunt.io
LightSpy Malware Now Targets Facebook & Instagram Data
A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.
blog · hunt.io
Decoy Manuals and Malicious Browser Extensions: A Closer Look at a Multi-Layered Threat
Hunt.io exposes a multi-stage campaign: a scheduled-task executable and 'Dark Mode' Chrome extensions built from open-source spying code, plus a decoy Cobalt Strike PDF pushing duplicates.
blog · hunt.io
Coin Miner and Mozi Botnet
Hunt examined an open directory on a Chinese web server holding 53 suspicious files — coin miners, a tampered TiviMate APK with risky Android permissions, and .m3u files targeting mobile devices.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Starting from a Joker-flagged 4K wallpaper APK, SSL certificate history pivots map the Android malware's C2 network across Alibaba Cloud servers and uncover related domains.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
back