Roaming Mantis

Roaming Mantis is a financially motivated mobile-focused malware operation and associated Android malware cluster also tracked as MoqHao and XLoader. It has been linked to the Yanbian Gang and is known primarily for large-scale smishing campaigns that impersonate parcel-delivery or app-update notifications to trick users into installing malicious Android applications, often disguised as updates for popular services such as browsers or social-media apps. The operation initially concentrated on Asian victims and later expanded internationally with multilingual landing pages and broader regional targeting.

On Android, Roaming Mantis functions as a malware platform for credential and financial theft, device compromise, and further propagation. Reported capabilities include stealing sensitive information, installing additional applications, and abusing infected devices to send more SMS phishing messages. Some variants have been described as Android banking trojans. The malware has also used backdoor-style command handling and evolving command-and-control retrieval methods, including techniques intended to improve resilience and evade disruption.

A notable feature of the operation is its use of DNS hijacking to redirect victims from legitimate destinations to attacker-controlled landing pages. Beyond redirecting mobile users to malicious APK delivery sites, the campaign also expanded to iOS-focused phishing, presenting fake Apple-themed pages designed to harvest account and payment-card data from iPhone users. For desktop users, operators have also used browser-based cryptocurrency mining on malicious landing pages.

Roaming Mantis has additionally demonstrated router-compromise functionality through its MoqHao component. On infected Android devices, the malware can identify local router models, interact with web administration interfaces, bypass text-based CAPTCHA protections using OCR services, brute-force router logins, and alter DNS settings. This enables downstream DNS hijacking and redirection to phishing or malware-delivery infrastructure. Reporting has indicated particular focus on certain Asia-linked router brands and on victims in South Korea during observed router-targeting activity.

The campaign is notable for continuous operational adaptation, including multilingual lures, dynamic payload generation, randomized package naming, and changing infrastructure-discovery mechanisms. Its victimology has spanned multiple countries across Asia, Europe, the Middle East, and elsewhere, with observed emphasis varying over time. Overall, Roaming Mantis is best characterized as a mobile-centric criminal malware ecosystem combining smishing-based initial access, credential theft, banking-trojan behavior, propagation, and network-level redirection through compromised routers.