Product
BTMOB Android RAT: MaaS Platform Targeting Android Devices
2 rules 6 TTPs 58 IOCsBTMOB is a Malware-as-a-Service (MaaS) Android RAT, first observed in February 2025, that uses phishing lures and the abuse of Android Accessibility Services to gain control of devices for data exfiltration, screen capture, and remote access.
Q1 2026 Mobile Threat Landscape: SparkCat and Triada Updates
2 rules 1 TTPThe Q1 2026 mobile threat landscape saw a decrease in overall attack volume driven by reduced adware and RiskTool detections, while the number of unique users targeted remained stable, with new SparkCat variants on app stores and increased banking Trojan and Triada backdoor activity.
CallPhantom Android Apps Falsely Promise Call History for Payment
2 rulesESET researchers discovered 28 fraudulent Android apps, named CallPhantom, on Google Play that falsely claim to provide call logs for any phone number in exchange for payment, generating random data or requesting email addresses and amassing over 7.3 million downloads before being removed.
ScarCruft (APT37) Deploying BirdCall Android Backdoor via Compromised Game Platform
2 rules 5 TTPs 1 IOCThe APT37 group (ScarCruft) is distributing an Android version of the BirdCall backdoor via a supply-chain attack targeting a Chinese video game platform, sqgame[.]net, to collect sensitive information from users.