Cyble’s CRIL identified OverlayPhantom, a new Android banking trojan distributed through malicious URLs that impersonate trusted apps such as ID Austria and TikTok. It targets more than 180 apps across 10 countries, stealing credentials with fake overlays and real-time screen streaming while using multi-port C2 infrastructure. #OverlayPhantom #IDAustria #TikTok #GooglePlayServices
Keypoints
- OverlayPhantom is a newly identified Android banking trojan actively distributed in the wild through malicious URLs.
- The malware uses a two-stage infection chain with a dropper that impersonates trusted apps, including ID Austria and TikTok.
- It masquerades as “Google Play Services” and abuses Android Accessibility Service for persistent control over infected devices.
- OverlayPhantom targets more than 180 banking, financial, and cryptocurrency apps across 10 countries.
- It uses embedded HTML phishing overlays to steal usernames, passwords, and card details from victims.
- The malware supports over 30 remote commands, including gesture automation, clipboard manipulation, screen locking, and fake notifications.
- It performs near real-time screen streaming via JPEG using Android’s MediaProjection API and a non-standard multi-port C2 setup.
MITRE Techniques
- [T1660 ] Phishing – OverlayPhantom is distributed through phishing sites and malicious URLs that impersonate trusted applications (‘distributed via phishing sites’ / ‘impersonates the official Austrian government identity application’).
- [T1624.001 ] Event Triggered Execution: Broadcast Receivers – The malware implemented a broadcast receiver to support screen capturing (‘implemented a broadcast receiver for screen capturing’).
- [T1628.001 ] Hide Artifacts: Suppress Application Icon – OverlayPhantom hides its app icon to make removal and detection harder (‘OverlayPhantom hides its icon’).
- [T1406 ] Obfuscated Files or Information – The malware uses obfuscated strings to hinder analysis (‘Malware uses obfuscated strings’).
- [T1655.001 ] Masquerading: Match Legitimate Name or Location – It disguises itself as legitimate Google Play components to mislead victims (‘masquerades as Google Play Service’).
- [T1453 ] Abuse Accessibility Features – OverlayPhantom abuses Android Accessibility Service to gain elevated control and monitor user activity (‘abuses Accessibility service’).
- [T1418 ] Software Discovery – The malware checks installed applications against a hardcoded target list to decide when to display phishing overlays (‘checks the installed application list against the target list’).
- [T1513 ] Screen Capture – OverlayPhantom captures the victim’s screen for real-time streaming (‘captures screen content’).
- [T1437 ] Application Layer Protocol – The malware communicates with its C2 using TCP-based connections (‘communicates with C2 over TCP’).
- [T1509 ] Non-Standard Port – It uses dedicated non-standard ports 9090, 9091, and 9092 for C2 functions (‘uses a non-standard port’).
- [T1646 ] Exfiltration Over C2 Channel – Stolen credentials and other data are exfiltrated to the C&C server (‘exfiltrates data to the C&C server’).
Indicators of Compromise
- [URL ] Distribution and lure URL for the malicious APK – hxxps://bitlrewards-app[.]com/api/download/IDAustria
- [IP address ] Command-and-control server used for OverlayPhantom communications – 199.217[.]99[.]122
- [SHA-256 file hashes ] OverlayPhantom sample hashes observed in analysis – 9ef37376bfaa18e193cc72218924ad8ebf56d2667d348f0eae5ae6ec45ab8775, f8b614a2918378063d6e6655b676ceb52ae65b1510e2cc08087fcac31acb7aeb, and 8ddc1f2a75f3d5b5bd054a5367bd5015ebc90f3453d63c7cce438c12dc2ae86a
Read more: https://cyble.com/blog/overlayphantom-android-banking-trojan/