Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan for Android called Octagon is impersonating the official emergency alerts application from Bahrain to seize control of devices and exfiltrate sensitive information.
The attack starts when users download the file BH-Alert.apk from phishing pages. The application mimics legitimate services and walks victims through seven separate steps to obtain dangerous permissions. The first component stores part of its code in encrypted form inside a file that uses a font extension. This content is decrypted and loaded only during runtime, making static analysis significantly more difficult.
After initial execution, the malware installs a second application named OctagonPanel. Dedicated surveillance services continuously monitor one another and automatically restart any components that are killed. Boot receivers ensure the threat reactivates after the device is powered on.
Octagon further creates a fake account on the Android system and schedules synchronization tasks every 30 minutes. This mechanism wakes the malware, fetches updated configuration data, and re-establishes communication with the command-and-control server.
By abusing the Accessibility Service, the threat records PINs, passwords, and unlock patterns. The 200 most recent entries can remain stored on the device before being transmitted. The RAT also collects SMS messages, contacts, call logs, and screenshots while displaying fake overlay pages for other applications. A VPN controlled by the attackers can intercept or redirect the victim’s network traffic.
Related articles
GOFFEE Dissects Custom COW Agent Forked from Poseidon Mythic Implant
Angara Security researchers uncovered a custom Go-based Mythic C2 agent named COW used by the Russian-oriented APT group GOFFEE, also known as Paper Werewolf. The agent represents an independent development branch derived from the public Poseidon project rather than its Freyja fork. Samples were heavily protected with Garble obfuscation and a modified UPX packer that required manual header reconstruction for unpacking. Analysis of surviving strings, build paths, and architectural features confirmed Poseidon origins while revealing numerous custom modifications including Windows support, additional C2 profiles, and new command implementations. The group employs the agent alongside other tools such as PowerTaskel, MiRat, and BindSycler for persistent access to Linux and Windows systems across government, energy, telecom, and defense targets. Researchers traced multiple variants through VirusTotal and incident reports, documenting evolutionary changes in configuration handling and peer-to-peer communication mechanisms.
Manic Android Malware Steals PINs via Transparent Overlay and Relays Data Through Nearby Infected Devices
A newly identified Android malware strain named Manic merges banking trojan, spyware, and remote access capabilities. The threat has been active since at least February 2026 and continues to receive updates that add anti-analysis features, in-memory code loading, and lock-screen credential theft. Manic monitors 169 financial, messaging, and government applications while using a transparent overlay on legitimate numeric keyboards to capture PINs without displaying a full fake banking screen. Stolen data can be forwarded through other compromised nearby devices even when the original phone lacks internet connectivity. Operators also leverage WebRTC sessions for live screen viewing and remote interaction. The malware additionally functions as a keylogger, intercepts SMS and notifications, and collects passwords, one-time codes, and recovery phrases. Security researchers recommend avoiding unknown APKs and scrutinizing requests for Accessibility Services or broad device control permissions.
Armored Likho Expands Arsenal with BusySnake RAT and AI-Driven Malware Development
The cybercrime group Armored Likho has introduced a new multi-platform trojan called BusySnake RAT that targets Windows, Linux, and macOS systems. Researchers at Kaspersky Lab identified three distinct versions of the malware, evolving from a Python implementation using Telegram bots for command-and-control to a GitLab-based variant and finally a fully rewritten Go version. In addition to custom development, the group has incorporated the open-source Kharon RAT to facilitate remote access and data exfiltration. Armored Likho has also shifted its infrastructure to private GitHub and GitLab repositories to hinder analysis. Most notably, the group now leverages large language models not only for initial access but also to generate tools for persistence and post-exploitation activities. Kaspersky security products continue to detect and block activity linked to the group.
Microsoft Removes WMIC from Windows 11 After Years of Abuse as LOLBIN by Ransomware and Attackers
Microsoft has begun permanently removing the legacy WMIC command-line utility from Windows 11, starting with versions 24H2 and 25H2. The tool is no longer available in fresh installations, has been dropped as an optional component, and is absent from the latest beta builds. WMIC provided text-based access to Windows Management Instrumentation for querying hardware, processes, services, and security software, as well as performing administrative tasks. Although the underlying WMI technology remains untouched, Microsoft has deprecated the command shell due to its long-standing use as a LOLBIN in cyberattacks. Ransomware operators have leveraged WMIC to delete shadow copies and hinder recovery, while other attackers used it to enumerate and disable security tools or add exclusions in Microsoft Defender. Administrators are directed to migrate to PowerShell, COM API, .NET libraries, and modern scripting languages, which will require rewriting legacy automation scripts.