Loading malware…
SpyNote, also known as SpyMax, is an Android malware family centered on remote access and surveillance of infected devices. It has been widely used as both a commercialized spyware framework and an operational malware family, with cracked and leaked variants contributing to broad adoption by criminal and espionage actors. Public reporting has linked SpyNote use to financially motivated campaigns, mobile surveillance operations, and targeted intrusions by state-aligned groups.
SpyNote targets Android devices and commonly abuses Accessibility Services to obtain extensive control over the user interface and device functions. Reported capabilities include remote device control, SMS and call-log theft, contact theft, location tracking, audio and video capture, screenshot capture, keylogging, clipboard theft, installed-app enumeration, and command execution. Multiple variants also support persistence-oriented behavior such as hiding the app icon, restarting background services, resisting removal, and installing or updating additional applications. Some samples use obfuscation, packing, malformed APK structures, dynamic loading, anti-emulation checks, and other anti-analysis or defense-evasion techniques.
The family has increasingly overlapped with banking-trojan and fraud tooling. Later SpyNote-derived variants have impersonated banks, cryptocurrency wallets, Google Play, WhatsApp, Facebook, and other popular applications. Observed financial-theft behaviors include Accessibility-driven credential theft, extraction of authenticator codes, overlay-based phishing, and automated interaction with banking or wallet apps. In some campaigns, SpyNote has been used to facilitate broader fraud chains by remotely installing secondary payloads such as NFC relay malware used in contactless payment fraud.
Distribution has occurred primarily through sideloaded Android applications delivered via phishing websites, deceptive third-party app sources, social media and messaging platforms, and direct social-engineering contact. SpyNote has also appeared in trojanized themed apps, including contact-tracing, transportation, club, chat, and cryptocurrency-related lures. Some campaigns used droppers such as SecuriDropper to bypass Android 13 Restricted Settings and enable subsequent Accessibility abuse.
SpyNote has been associated with a wide range of threat activity, including campaigns targeting banking customers, cryptocurrency users, Indian railway users, Indian defense personnel, Arabic-speaking targets in Syrian surveillance operations, Palestinian targets, and victims in contactless payment fraud schemes in Central Europe. Its prevalence, modularity, and convergence of spyware, RAT, and financial-fraud functionality have made it one of the most prominent Android malware families in recent years.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Spynote – Commercially available Android RAT (cracked versions available)
A large portion of the malicious applications are SpyNote samples... Of the malicious applications in this campaign, 64 of 71 are SpyNote samples, a well known commercial surveillanceware family.
In addition to their custom-made malware, this group also utilized publicly available Android malware called SpyNote which had more functionality including remote device access and the ability to monitor calls.
An example of a long-standing and continuously evolving threat in this domain is the SpyNote malware, also known under related names such as CypherRat and SpyMax. SpyNote is a Remote Access Trojan (RAT) family that has been present in the mobile threat landscape for several years.
An example of a long-standing and continuously evolving threat in this domain is the SpyNote malware, also known under related names such as CypherRat and SpyMax. SpyNote is a Remote Access Trojan (RAT) family that has been present in the mobile threat landscape for several years.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The most recent versions of SpyNote are not only extremely powerful, but they also include a variety of security features, from simple string obfuscation to the use of commercial packers.
SpyNote.C has been the first variant to openly target banking applications, impersonating a large number of reputable financial institutions like HSBC, Deutsche Bank, Kotak Bank, BurlaNubank, as well as others to well-known applications like WhatsApp, Facebook, and Google Play. In addition, we also observed that the attackers utilize more generic application masquerades, such as wallpaper apps, productivity apps, or gaming apps.
The following code recognizes the use of a legitimate crypto wallet and displays an overlay over it. The injected overlay consists of a WebView whose HTML is hard-coded in Base64. | For example, the malicious sample uses the Accessibility API to record device unlocking gestures.
Malicious functionality in these trojanized contact-tracing applications includes: ... Keylogging ...
SpyNote also has the capacity to function as a social app credential stealer. This is done by deceiving users into entering their private login information during the login process by launching a webpage with a custom layout that looks a lot like famous services like Gmail and Facebook, much like a traditional overlay attack
The following code recognizes the use of a legitimate crypto wallet and displays an overlay over it. The injected overlay consists of a WebView whose HTML is hard-coded in Base64. | For example, the malicious sample uses the Accessibility API to record device unlocking gestures.
Malicious functionality in these trojanized contact-tracing applications includes: ... Keylogging ...
Malicious functionality in these trojanized contact-tracing applications includes: ... Voice, Screen, and Camera recording and exfiltration
MITRE ATT&CK Tactics Techniques Defense Evasion Application Discovery Obfuscated Files or Information, Virtualization/Sandbox Evasion Discovery Security Software Discovery, System Information Discovery Collection Email Collection, Data from Local System
We analyzed the C&C command ‘info’ and the associated APK. This command collects the clipboard data
Malicious functionality in these trojanized contact-tracing applications includes: ... Voice, Screen, and Camera recording and exfiltration
Ability to use the Camera API to record and send videos from the device’s camera to the Command and Control(C&C) center
Use the Camera API to record and send videos from the device to the C2 server
Once installed, the threat actor abuses SpyNote's remote access to install the NFC relay malware without any further user interaction.
MITRE ATT&CK Tactics Techniques ... Command and Control Encrypted Channel, NonStandard Port
MITRE ATT&CK Tactics Techniques Defense Evasion Application Discovery Obfuscated Files or Information, Virtualization/Sandbox Evasion Discovery Security Software Discovery, System Information Discovery Collection Email Collection, Data from Local System Command and Control Encrypted Channel, NonStandard Port
186 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used to gain control of the victim's Android device, allowing the fraudster to install WindRelay and operate the victim’s banking app remotely.
Android remote access trojan used to gain control of the victim phone, silently install WindRelay, and remotely operate the victim’s banking app during the fraud workflow.
Remote access trojan used to gain Accessibility Service access, silently sideload and activate the NFC relay app, and provide persistent remote control that supports the broader fraud operation.
Android remote access trojan used to gain remote control of victim devices, steal banking and account credentials, Google Authenticator codes, GPS data, and SMS messages, and activate microphone and camera or intercept keystrokes.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.