Android Droppers Adapt to Evade Google Play Protect’s Pilot Program
Summary
ThreatFabric reports that Android droppers are increasingly used to deliver even basic spyware and SMS stealers, concealing payloads until after installation to evade Google Play Protect’s Pilot Program checks.
Key points
- ThreatFabric says droppers have expanded beyond banking trojans to deliver SMS stealers and spyware, including apps disguised as government or banking apps in India and other parts of Asia.
- Google’s Pilot Program scans apps before installation in selected high-risk regions, checking for risky permissions, suspicious API calls, and high-risk behavior, especially in sideloaded apps.
- In ThreatFabric’s test, a dropper displaying an update prompt installed successfully and then fetched or decrypted a payload after the user clicked Update; the payload could subsequently request sensitive permissions.
- ThreatFabric says Play Protect may still show warnings, and users who choose to proceed can allow installation and payload delivery.
- RewardDropMiner has previously delivered spyware, fallback spyware, and a remotely triggered Monero miner; ThreatFabric says its recent RewardDropMiner.B variant retains dropper functionality but omits the miner and fallback spyware.
- The article cites SecuriDropper, Zombinder, BrokewellDropper, HiddenCatDropper, and TiramisuDropper as other examples of staged delivery or attempts to bypass Android protections.
Article Details
- Attack Vectors
- Droppers are disguised as government or banking apps and distributed through third-party sources or fake websites.
- After the user taps an “Update” prompt, a dropper fetches or decrypts a payload, then requests sensitive permissions when launching it.
- Some droppers use the Session Installer API to install payloads while delaying permission requests until after installation.
- The article reports that Zombinder has been used to distribute SpyNote samples, including through messaging apps such as WhatsApp.
- Defensive Notes
- The article describes Google Play Protect’s Pilot Program scanning apps immediately before installation, particularly sideloaded apps, for risky permissions, suspicious API calls, and high-risk behaviors.
- The Pilot Program may block apps that request risky permissions, but the article reports that users can accept warnings and proceed with installation.
- The article recommends adapting detection as droppers change their delivery methods to evade scanning.
MITRE ATT&CK
Malware
BrokewellDropperWe’ve seen similar techniques in multiple droppers such as Zombinder, BrokewellDropper, HiddenCatDropper tied to banking malware, and TiramisuDropper, Zombinder in distributing SpyNote samples, especially thoseHiddenCatDropperWe’ve seen similar techniques in multiple droppers such as Zombinder, BrokewellDropper, HiddenCatDropper tied to banking malware, and TiramisuDropper, Zombinder in distributing SpyNote samples, especially thoseRewardDropMinerRewardDropMiner: A Multi-Purpose DropperRewardDropMiner.BBut in the most recent variant (RewardDropMiner.B), the operator has stripped out both the miner and the fallback spyware, keeping only the dropper functionality.SecuriDropperFor example, Dropper family such as SecuriDropper, a Two-staged dropper that was basically built to bypass Android 13 restrictions reported by us installs payload using Session Installer API which by delaying permissionSpyNoteHiddenCatDropper tied to banking malware, and TiramisuDropper, Zombinder in distributing SpyNote samples, especially those distributed through messaging apps like WhatsApp or via fake websites.TiramisuDroppermultiple droppers such as Zombinder, BrokewellDropper, HiddenCatDropper tied to banking malware, and TiramisuDropper, Zombinder in distributing SpyNote samples, especially those distributed through messaging apps likeZombinderWe’ve seen similar techniques in multiple droppers such as Zombinder, BrokewellDropper, HiddenCatDropper tied to banking malware, and TiramisuDropper, Zombinder in distributing SpyNote samples, especially those
Vendors
Products
Countries
Brazilinitiative aimed at tackling financial fraud on Android devices in high-risk regions such as India, Brazil, Thailand, and Singapore, with a likely expansion to other parts of Asia in the near future.India“simple” malware such as SMS stealers and basic spyware, often disguised as government or banking apps in India and other parts of Asia.Singaporetackling financial fraud on Android devices in high-risk regions such as India, Brazil, Thailand, and Singapore, with a likely expansion to other parts of Asia in the near future.Thailandaimed at tackling financial fraud on Android devices in high-risk regions such as India, Brazil, Thailand, and Singapore, with a likely expansion to other parts of Asia in the near future.