Malware
KYCShadow
- First Reported
- Apr 24, 2026
- Latest Reported
- May 4, 2026
Reported Context (2)
- New KYCShadow Android Malware Detected —An Android malware masquerading as a bank KYC verification application is being distributed via WhatsApp and primarily targeting users in India. Weekly Cybersecurity Recap: Active cPanel and Linux Exploits, Supply-Chain Attacks and New Malware
- KYCShadow is a multi-stage Android banking malware distributed via WhatsApp that uses a dropper (com.***appad.andr) to install a hidden secondary payload (com.am5maw3.android) which harvests credentials and OTPs through KYCShadow Android Malware Uses Fake KYC Workflows to Steal Credentials and OTPs
CVE (5)
Malware (7)
People (1)
Threat Actors (9)
MITRE ATT&CK (27)
Vendors (6)
Products (12)
Tools (3)
Industries (9)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.