Phenakite

Android malware was typically hosted on convincing looking attacker-controlled phishing sites. At the time of this writing, we discovered 41 such sites.

It used sprawling infrastructure to support its operations, including over a hundred websites that either hosted iOS and Android malware, attempted to steal credentials through phishing or acted as command and control servers.

This spike in account creation towards the later half of 2019 was observed alongside an increase in attempts to distribute both iOS and Android malware as well as phish credentials from users.

In all cases the successful installation of these tools did not require any exploits. This suggests that Arid Viper operators continue to heavily rely on social engineering to distribute their malware.

They also bundled Windows malware in the installer package for their own decoy application for journalists to submit human rights-related articles for publication.

Post-installation, a jailbreak was necessary for the malware to elevate its privileges to retrieve sensitive user information not accessible via standard iOS permission requests. This was achieved with the publicly available Osiris jailbreak that made use of the Sock Port exploit.

This malware masqueraded as secure chat applications.

Phenakite comes bundled with the publicly available Osiris jailbreak and also includes the Sock Port exploit.

It relied on social engineering to trick people into clicking on malicious links and installing malware on their devices.

This malware could also direct people to phishing pages for Facebook and iCloud to steal their credentials for those services.

This malware could also direct people to phishing pages for Facebook and iCloud to steal their credentials for those services.

Retrieve photos from the camera roll ... Retrieve contacts ... Retrieve text messages ... Search for and return the path of files with a doc or PDF extension

This malware could also direct people to phishing pages for Facebook and iCloud to steal their credentials for those services.

Phenakite periodically recording audio and notifying C2 infrastructure... Similarly, Phenakite periodically uses the camera of a compromised device to take photos

Phenakite periodically uses the camera of a compromised device to take photos and sends these automatically to attacker infrastructure.

Once collected, the malware would upload the data to Firebase, a mobile app development platform.

Examples in the content include: 'Riltok can access and upload the device's contact list to the command and control server,' 'Rotexy can access and upload the contacts list to the command and control server,' and multiple entries stating malware can 'exfiltrate' contacts.