GoldPickaxe Returns: When Your Biometric Information is as Important as Your Money

MITRE Techniques

• [T1660 ] Phishing – Threat actors used spoofed websites mimicking KuaiBo to trick users into downloading the malicious Dropper APK (‘spoofed websites mimicking the Chinese video-streaming platform KuaiBo’).
• [T1623 ] Command and Scripting Interpreter – The malware abused the Android SessionInstaller API to install the secondary payload while bypassing sideloading and accessibility restrictions (‘abuses the legitimate Android SessionInstaller API’).
• [T1624.001 ] Event Triggered Execution: Broadcast Receivers – The sample used system event triggers and background broadcast receivers to initialize or restart without direct user interaction (‘ensure the malware automatically initializes or restarts’).
• [T1628.001 ] Hide Artifacts: Suppress Application Icon – The payload omitted MAIN and LAUNCHER intent filters so no home-screen icon appeared (‘deliberately excludes these conventional entry points’).
• [T1406 ] Obfuscated Files or Information: Dynamic Code Loading – The malware hid logic in an encrypted payload_dex.bin file and loaded it at runtime using AES keys from local files (‘dynamically loads it into memory’).
• [T1629 ] Impair Defenses – It malformed XML to crash JADX/Apktool and disabled facial recognition to force PIN fallback (‘trigger parsing failures’ and ‘turn off native facial recognition’).
• [T1655 ] Masquerading – The threat used activity-alias redirects and fake overlays, including a fake Indonesian Ministry app and fake AppDialog prompts, to deceive victims (‘masquerade as an official Indonesian ministry application’).
• [T1417.002 ] Input Capture: GUI Input Capture – A fake lock screen captured PINs, patterns, or passwords, while keylogging monitored input (‘steal the victim’s device unlock credentials’).
• [T1418 ] Software Discovery – The malware enumerated installed apps and extracted names, package names, and icons (‘extracts the name, packageName, and icon from every application’).
• [T1426 ] System Information Discovery – It collected device profiling data to adapt attack vectors (‘leak information about the device’).
• [T1636.004 ] Protected User Data: SMS Messages – The sample intercepted and exfiltrated SMS logs and incoming text messages (‘exfiltrating sensitive SMS logs’).
• [T1636.002 ] Protected User Data: Contacts List – It accessed and exfiltrated the victim’s contacts list (‘contact lists’).
• [T1636.003 ] Protected User Data: Call Logs – It harvested and leaked call history logs (‘Leak CallLog’).
• [T1453 ] Abuse Accessibility Features – The malware used Accessibility Services to scrape live screen elements and send them to C2 in JSON (‘leverage Android’s Accessibility Services’).
• [T1513 ] Screen Capture – The sample abused Media Projection to enable live screen sharing and UI visibility (‘activate screen sharing’).
• [T1512 ] Video Capture – It hijacked the camera to record facial video during fake verification flows (‘record a video of their face’).
• [T1521.001 ] Encrypted Channel – Network traffic was encrypted by libnaLib.so using AES and dynamic IVs (‘encrypting all data exchanged with the C2 panel’).
• [T1544 ] Ingress Tool Transfer – The malware processed remote C2 commands to download and deploy secondary APK payloads (‘fetch and download secondary APK payloads’).
• [T1646 ] Exfiltration Over C2 Channel – Collected biometrics, ID photos, SMS tokens, and credentials were sent over the C2 channel (‘transmits all collected sensitive data’).
• [T1516 ] Input Injection – It injected payloads such as pattern-lock and login overlays to steal credentials (‘mimics banking apps login screen through overlay’).