Gate News message, April 25 — Cybersecurity firm Zimperium has identified four active malware families—RecruitRat, SaferRat, Astrinox and Massiv—targeting over 800 applications across banking, cryptocurrency and social media sectors. The campaigns employ advanced anti-analysis techniques and structural APK tampering to maintain near-zero detection rates against traditional signature-based security mechanisms.
Attackers use phishing websites, fraudulent job offers, fake software updates, text-message scams and promotional lures to trick users into installing malicious Android apps. Once installed, the malware requests Accessibility permissions to hide app icons, block uninstall attempts, steal PINs and passwords via fake lock screens, intercept one-time passcodes, record live device screens and overlay counterfeit login pages on legitimate banking or crypto applications.
Overlay attacks form the core of the credential-harvesting strategy. The malware monitors the foreground using Accessibility Services and detects when a victim launches a financial app, then fetches a malicious HTML payload and overlays it onto the legitimate interface to create a convincing deceptive facade.
The campaigns use HTTPS and WebSocket communications to blend malicious traffic with normal app activity, with some variants employing additional encryption layers to further evade detection.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
TRADOOR Token Crashes 90% in 30 Minutes Amid Suspected Price Manipulation and Wash Trading
Gate News message, April 25 — TRADOOR token experienced a sharp 90% price crash over 30 minutes at 2:00 AM today, according to on-chain analyst Specter. The token had surged as much as 900% since March 2026 before the sudden collapse, raising suspicions of price manipulation and coordinated
GateNews2h ago
Lending Protocol Purrlend Suffers Attack, Loses $1.52 Million Across MegaETH and HyperEVM
Gate News message, April 25 — Lending protocol Purrlend fell victim to attacks on both the MegaETH and HyperEVM networks today, resulting in losses of approximately $1.52 million.
Attackers extracted roughly $1.2 million in assets from the HyperEVM network, including 449,683 USDC, 214,125
GateNews3h ago
Ben Pasternak Arrested for Assault at NYC Hotel Amid $54M Crypto Fraud Lawsuit Over Believe Token
Gate News message, April 25 — Ben Pasternak, the 26-year-old Australian entrepreneur behind the Solana-based SocialFi platform Believe, was arrested on April 22 and charged with second-degree strangulation and two counts of third-degree assault following an alleged physical altercation with his ex-g
GateNews4h ago
Independent Researcher Cracks 15-Bit ECC Key, Wins Bitcoin Reward from Project Eleven
Gate News message, April 25 — Independent researcher Giancarlo Lelli successfully cracked a 15-bit ECC encryption key protecting Bitcoin and received the Q-Day Award plus 1 BTC from quantum security startup Project Eleven.
Lelli used publicly available quantum hardware and a variant of Shor's
GateNews5h ago
22-Year-Old California Crypto Launderer Sentenced to 70 Months for $263M Fraud Scheme
Gate News message, April 25 — Evan Tangeman, 22, from Newport Beach, California, was sentenced to 70 months in prison on April 24 for his role in laundering $263 million obtained through a massive cryptocurrency fraud scheme. The U.S. District Court in Washington, D.C., imposed the sentence
GateNews7h ago
Colombia and U.S. Authorities Dismantle CJNG-Linked Crypto Laundering Network Worth $190M
Gate News message, April 25 — Colombian and U.S. law enforcement agencies have jointly dismantled a transnational cryptocurrency money laundering network linked to Mexico's Jalisco New Generation Cartel (CJNG). The network has transferred over $190 million in illicit funds through crypto channels
GateNews9h ago
