Crypters and Similar Techniques Can Help Mobile Malware Evade Signature-Based Detection
Summary
An Australian-led advisory warns about crypters used to evade endpoint detection. Zimperium explains that similar obfuscation techniques affect Android malware and argues for combining signature, behavioral, and AI-based detection.
Key points
- The joint ASD, AFP, New Zealand Police, Google, and UK NCA advisory addresses crypters used to disguise malware from endpoint security tools; it was not specifically about mobile malware.
- The article says Android malware has used comparable techniques, including APK tampering, encrypted payloads, dynamic loading, and anti-analysis checks.
- Recorded Future research cited in the article found at least two crypter vendors advertising Android APK crypting, including a claim of Google Play Protect evasion.
- Re-obfuscating malware can change its signature and extend its useful lifespan, making static, signature-based scanning less effective.
- Zimperium reports that its research tracked mobile malware campaigns targeting more than 800 banking, cryptocurrency, and social media apps.
- The article recommends combining known-threat detection with behavioral analysis and AI-based anomaly detection rather than relying on signatures alone.
Article Details
- Topic
- Mobile malware evasion through crypters and obfuscation-as-a-service, and mobile security detection and protection approaches.
People
Malware
AstrinoxZimperium's own zLabs research on the RecruitRat, SaferRat, Astrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encryptedMassivZimperium's own zLabs research on the RecruitRat, SaferRat, Astrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encryptedRecruitRatZimperium's own zLabs research on the RecruitRat, SaferRat, Astrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encryptedSaferRatZimperium's own zLabs research on the RecruitRat, SaferRat, Astrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encrypted
Vendors
Recorded FutureAccording to threat intelligence research published by Recorded Future's Insikt Group in August 2026, which analysed 24 active crypter vendors, entry-level services start at as little as $30 per crypt, while mid-tierZimperiumZimperium's own zLabs research on the RecruitRat, SaferRat, Astrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encrypted
Products
Google Play Protecttwo of them explicitly advertise APK crypting for Android apps, including one vendor claiming Google Play Protect evasion, which confirms this is not solely a desktop or server problem.Mobile Application Protection SuiteSecure the App — Mobile Application Protection Suite (MAPS)Mobile Threat DefenseSecure the Device — Mobile Threat Defense (MTD)
Countries
AustraliaWhile the advisory originates in Australia, crypter services operate without borders.New ZealandA joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercialUnited Kingdom
Industries
Bankingresearch on the RecruitRat, SaferRat, Astrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encrypted payloads, dynamic codeCryptocurrencythe RecruitRat, SaferRat, Astrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encrypted payloads, dynamic code loading, andFinancial ServicesInsuranceZimperium protects 1,500+ global enterprises, including 109 banking and insurance institutions across 36 countries, and scans more than 100 million unique apps annually.Social mediaAstrinox, and Massiv campaigns, together targeting more than 800 banking, cryptocurrency, and social media apps, found advanced APK tampering, encrypted payloads, dynamic code loading, and environment-aware