SpyNote’s New Lure: The Stealthy Campaign Using Fake App Stores

According to DomainTools, researchers have uncovered a persistent SpyNote Android Remote Access Trojan (RAT) campaign in which threat actors use deceptive Google Play Store clones to lure victims into downloading malicious APKs. SpyNote is described as a highly intrusive Android RAT with extensive capabilities for surveillance, data exfiltration and device manipulation, including the ability to remotely control a device’s camera and microphone, manage phone calls and execute commands.

A notable feature is the abuse of Android Accessibility Services to intercept and steal 2FA codes, with the malware also able to remotely wipe data, lock the device or install additional malicious applications if granted administrator rights. The delivery APK acts as a dropper and decrypts its payload using a key derived from the app’s manifest, loading SpyNote via a technique known as DEX Element Injection.

The C2 infrastructure uses multiple hardcoded domains and obfuscation to hinder analysis, while two primary IP addresses, 154.90.58[.]26 and 199.247.6[.]61, are associated with the campaign. The threat actor is described as persistent but with limited sophistication, continuing to rely on the same cloning tactic to lure unwary consumers, with the campaign financially motivated to steal credentials and data and potentially use the surveillance features for extortion or fraud. The report notes attribution remains unclear, though Chinese-language comments in the delivery code offer some clues.