Octagon Android Malware Uses Fake Bahrain Alert App to Capture Lock-Screen Credentials
Summary
K7 researchers analyzed Octagon, an Android threat impersonating Bahrain’s BH Alert app. It decrypts and dynamically loads payloads, abuses VPN and Accessibility services, and uses fake accounts for persistence; the child app captures lock-screen credentials.
Key points
- The campaign targeted users in Bahrain with a fake BH Alert app distributed through phishing links.
- K7 researchers used Frida to observe an encrypted asset being RC4-decrypted and loaded as DEX code with DexClassLoader.
- The malware installs a child APK in memory; that APK generates and dynamically loads a JAR payload.
- The malware abuses Android VPN permissions to intercept and redirect traffic, while excluding selected apps from the VPN tunnel.
- The child APK uses Accessibility Service to capture lock-screen PINs, passwords, and patterns, storing captured data locally.
- A fake Android account and periodic sync activity help maintain persistence; the malware also stores its configuration and pending data locally.
Article Details
- Attack Vectors
- The malware impersonates the BH Alert emergency application and uses phishing URLs to distribute a fake APK.
- After installation, it extracts an encrypted asset, decrypts it with an RC4-based routine, and loads the resulting DEX using DexClassLoader.
- The malware requests VPN permission and uses a VPN tunnel to intercept and redirect device traffic, while excluding selected applications.
- It installs an embedded child APK through a PackageInstaller session; the child APK dynamically loads a JAR payload.
- The child APK abuses Accessibility Service to capture lock-screen PINs, passwords, and unlock patterns, and stores collected information locally.
- It registers a fake AccountManager account and uses periodic synchronization and saved configuration to maintain persistence and reconnect to its C2 server.
- Defensive Notes
- Scan mobile devices with a reputable security product and keep it active and updated.
- Patch devices for known vulnerabilities.
- Download software only from reputable platforms such as Google Play and the App Store.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 209[.]99[.]184[.]50 | C2 server address configured by the malware; the article gives port 4444. |
| MD5 | 58330aaf1f533e9fe03b6355c60347b4 | Malware/package hash listed for the com.kisa.octagonpanel child APK. |
| MD5 | 9694294addbe58be93ddbb6cabc499ce | Malware/package hash listed for the com.kit.kitty package. |
| URL | hxxps[:]//bh-alert[.]com/assets/BH-Alert.apk | URL listed as a phishing and distribution link for the fake app. |
| URL | hxxps[:]//download[.]alertbh[.]info/BH-Alert.apk | Phishing and distribution URL for the fake BH Alert APK. |
| URL | hxxps[:]//playgoogle[.]bh-alert[.]com | URL listed as part of the fake app's phishing and distribution infrastructure. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe fake app impersonates BH Alert and uses an icon similar to the MyGov – Bahrain app.T1041 · Exfiltration Over C2 ChannelCollected information and pending responses are stored locally for later transmission to the C2 server.T1136.001 · Local AccountThe SyncHelper class registers a fake OctagonPanel account through Android's AccountManager.T1204.002 · Malicious FileVictims are tricked into installing the fake BH-Alert.apk obtained from a phishing link.T1406The malware decrypts an encrypted asset, ZfChs.ttf, to produce a DEX payload.T1417.001The child APK uses Accessibility Service to capture entered lock-screen PINs, passwords, and unlock patterns.T1437.001The fake APK is distributed through phishing URLs using HTTPS.T1573 · Encrypted ChannelThe article describes encrypted communication and a stored encryption passphrase in the malware's C2 configuration.T1620 · Reflective Code LoadingThe malware decrypts ZfChs.dex and loads it at runtime using DexClassLoader; the child APK also dynamically loads ZGdSEl.jar.
Malware
Products
AndroidOctagon is a multi-stage Android threat that impersonated the BH Alert emergency app to target users in Bahrain and deploy dynamically loaded DEX/JAR payloads.BH AlertOctagon is a multi-stage Android threat that impersonated the BH Alert emergency app to target users in Bahrain and deploy dynamically loaded DEX/JAR payloads.
Tools
Android Debug Bridge (ADB)As shown in Figure 11, analysis of the ADB logcat output revealed that the child APK generates an additional JAR file (ZGdSEl.jar) under /data/user/0/com.kisa.octagonpanel/app_walk/ and dynamically loads it at runtimeFridaTo validate this behavior, we instrumented the application using Frida and monitored its runtime file activity.