Octagon Malware-as-a-Service Platform Targets Android Banking Apps and Crypto Wallets for $1400 Monthly Subscription
Researchers from iVerify have discovered a previously unknown malware platform called Octagon designed for attacks on Android banking applications and cryptocurrency wallets. The toolkit is distributed under a malware-as-a-service model, with a Russian-speaking seller using the handle AndroidKitKat charging $1400 per month for access.
Octagon first appeared on a cybercrime forum on 1 June 2026, and by 29 June the author had already announced version 1.2. Subscribers receive a ready-made control panel capable of capturing accounts at banks, cryptocurrency exchanges, messengers, and wallets. Infection begins when the victim installs an APK file disguised as a harmless application.
After installation, the program requests activation of Android Accessibility Services. Once granted, the trojan can read on-screen interface elements, press buttons, enter text, and perform system actions directly on the victim’s device. Because operations occur on the compromised smartphone itself, banks and exchanges see the legitimate IP address, device fingerprint, installed applications, and an already authenticated session, making the activity appear normal to anti-fraud systems.
The platform supports hidden remote screen control similar to VNC, captures screenshots, launches applications, and simulates touches. It overlays phishing windows on top of interfaces belonging to Trust Wallet, Binance, MEXC, and other services to harvest passwords, PIN codes, and seed phrases. A dedicated module intercepts SMS messages containing one-time codes, transaction confirmations, and account-recovery links. Attackers can even spoof the system lock screen to steal the device’s graphical pattern or password.
Investigators identified three related builds: Octagon, Lifted Dreams, and BahrDate. In one variant, after permissions are granted, a visual novel is displayed to the user while the spyware continues operating in the background. Security experts advise users to avoid installing APK files from unknown sources and to refrain from granting Accessibility Services or SMS permissions to untrusted applications.
Related articles
Website Protection Against Bots: Six Years of Traffic Filtering Evolution from Behavioral Bots to Multi-Layer Analytics
The article traces the author's journey starting in 2020 when anomalous traffic from social networks began flooding websites, initially appearing as visits from Twitter, Instagram, YouTube, and VKontakte. Early attempts using .htaccess rules to block referrers failed as bots dynamically switched to direct or external domain transitions. Server-side JavaScript and cookie checks altered bot behavior but did not stop the flow, revealing that successful browser checks only confirm technical capability rather than human presence. IP blocking of ranges like 31.173.80.0/21 and 178.176.64.0/19 provided temporary relief until mobile proxies rotated addresses, exposing the limits of static blacklists. IPv6 adoption further demonstrated how address-family-specific rules quickly become obsolete. Fingerprint spoofing and constant rotation of digital prints made single-signal identification unreliable. The core lesson emphasizes real-time filtering at the edge over post-hoc analytics exclusion to prevent bots from reaching the web server at all.
Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have detailed Drama RAT, a sophisticated Android banking trojan distributed via phishing messages in messengers and disguised as VPN services or banking apps. The malware uses droppers that request installation of fake updates, then deliver a full-featured payload capable of stealing credentials, recording screens, and performing overlay attacks. Drama RAT automatically grants itself Accessibility permissions while hiding the process behind opaque overlays and employs multiple persistence mechanisms including AlarmManager alarms and Doze mode bypass. Communication occurs primarily over mTLS WebSocket with a fallback CDN channel, while anti-analysis features include over 1200 junk artifacts, broken AndroidManifest.xml, Frida hooking detection, and per-class string obfuscation. The trojan supports keylogging, SMS interception, VNC screen sharing, microphone and camera recording without indicators, and participation in DDoS attacks. Positive Technologies notes that removal is extremely difficult without ADB or safe mode because the malware redirects users away from settings screens.
Attackers Abuse Legitimate Node.js Runtime to Deploy Persistent Malware in Targeted Operations
Cybercriminals are increasingly misusing the legitimate Node.js runtime to execute malicious JavaScript scripts and maintain persistence on corporate networks. The technique has been observed since February 2026 against governments, technology firms, hotels, and financial organizations. Attackers favor the signed node.exe binary to evade signature-based detections after initial access via ClickFix social engineering. In one case against an Asian technology company, Node.js was deployed following blocked attempts to install AdaptixC2 and Cobalt Strike. The resulting implant establishes registry persistence and communicates with Ethereum blockchain gateways to retrieve commands hidden in smart contracts. The approach has been linked to multiple tools including ModeloRAT, Mistic, EtherRAT, and a variant of AsukaStealer, with some campaigns attributed to the initial-access broker Woodgnat, also known as KongTuke.
Buhtrap RAT Resurfaces in New Campaign Targeting Russian Accountants via Search Ads
Specialists from F6 have identified a fresh distribution campaign for the Buhtrap RAT remote access trojan. Attackers continue to lure accountants and lawyers to counterfeit professional websites promoted through search engine advertisements. The latest lure mimics the legitimate resource Glavnaya Kniga Bukhgaltera, where visitors seeking documents instead receive a ZIP archive containing malicious payload delivered through JavaScript interception. The infection chain remains largely unchanged from prior operations, with the primary update being refreshed command-and-control infrastructure. Buhtrap has operated since 2014 as both malware and an associated criminal group; its source code leak in 2016 enabled wider adoption by financially motivated actors. Identified decoy domains include glavaudit.org, buhotchet.com, and audit24.org. Users are advised to verify site addresses carefully and avoid executing disguised EXE files.