The Android TV community faces a significant security crisis as SmartTube, a popular third-party YouTube client, has been compromised due to exposed signing keys.

Security researchers have identified malicious code embedded within official releases, prompting Google to forcibly disable the application on affected devices.

The incident, which came to light through extensive community analysis, demonstrates how compromised developer credentials can lead to widespread distribution of malware through legitimate channels.

Users first noticed the issue when Google Play Protect flagged SmartTube as dangerous and automatically disabled it on Android TV devices.

System notifications warned that “Your device is at risk,” moving the app to a disabled section where reactivation became impossible.

Security analyst/researcher, Yuriy L (@yuliskov) noted or identified that his digital signature had been exposed, allowing attackers to inject malicious libraries into official builds distributed through GitHub releases and in-app updates.

The developer responded by revoking the compromised signature and announcing plans to migrate to a new signing key, though the damage had already spread across multiple versions.

Forensic analysis of infected APKs revealed a sophisticated implant hidden within native libraries.

The malicious component, identified as libalphasdk.so or libnativesdk.so, loads automatically when the application starts through a broadcast receiver called io.nn.alpha.boot.BootReceiver.

This triggers JNI exports including startSdk1, stopSdk1, getBandwidthDelta1, and getIsRegistered1, which initialize a background surveillance mechanism.

The library collects extensive device fingerprinting data including manufacturer, model, Android SDK version, network operator, connection type, local IP address, and unique identifiers stored in shared preferences under the alphads db namespace.

This information is transmitted using a custom networking stack that leverages Google infrastructure to mask its command-and-control communications.

Infection Mechanism and Persistence Tactics

The malware establishes persistence through multiple layers of deception designed to evade detection. When SmartTube launches, the malicious native library initializes without user interaction, registering timers that execute every second for registration polling and every 60 seconds for bandwidth monitoring.

The library enforces bandwidth limits downloaded from remote configuration, suggesting server-side control over infected devices.

Analysis shows hardcoded references to drive.google.com, www.google.com, and dns.google, indicating the use of Google Drive and DNS-over-HTTPS as covert channels for command-and-control operations.

Configuration files named neunative.txt and sdkdata.txt are fetched from these trusted domains, allowing the malware to blend legitimate Google traffic with malicious activity.

The persistence mechanism remains active as long as the main application runs, with no visible indicators to the user.

Detection proves challenging because the malicious .so files appear alongside legitimate libraries like libcronet.98.0.4758.101.so, libglide-webp.so, and libj2v8.so in the lib folder.

Users can check for infection by examining APK contents for unexpected native libraries, with infected versions including 30.43 through 30.55 while clean versions stop at 30.19.

The developer confirmed his entire development environment required wiping, suggesting the compromise extended beyond simple key theft to potential supply chain infiltration.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post SmartTube YouTube App for Android TV Compromised Following Exposure of Signing Keys appeared first on Cyber Security News.

The Arkanix stealer is a new malware family now spreading in the wild. It targets home users and small offices that rely on VPN clients and wireless networks for daily work.

Once active, it focuses on stealing VPN account data, Wi‑Fi profiles, browser credentials, and desktop screenshots.

This gives attackers direct access to private networks and a clear view of what the victim is doing.

Early attacks use simple but effective lures. Victims are tricked through fake software downloads, cracked tools, or email links that drop a small loader.

This loader then pulls the main Arkanix payload from a remote server and runs it without drawing attention.

The whole chain is built to look like a normal installer, which helps it blend into routine user activity.

G Data Cyber Defense security analysts identified Arkanix during an investigation into new info‑stealing campaigns.

Their telemetry showed repeated theft of VPN profiles and Wi‑Fi keys from systems in Europe and other regions, with the same code base behind the attacks.

Further analysis revealed a modular design that lets operators switch targets quickly, from browser data to screenshots or other files.

Once loaded, Arkanix scans the system for VPN configuration files, password stores, and saved wireless profiles. It exports them into a single archive, adds fresh screenshots from the active desktop, and then sends everything to a command‑and‑control (C2) server.

Network captures show outbound HTTPS requests that hide this theft inside encrypted traffic, making it harder to spot.

Infection chain and data theft

The main binary runs simple but focused code to collect data. A common pattern is a loop that walks known paths for VPN and Wi‑Fi data, then posts them to the C2 endpoint:-

for each(path in target_paths){
    grab_files(path);
}
take_screenshot();
upload_to_c2(zip_all());

A configuration panel used by the malware author controls which modules run, such as Wi‑Fi theft or screenshot capture.

This complete technical breakdown shows that Arkanix is built for direct access: steal VPN accounts, map Wi‑Fi networks, watch the screen, and then let intruders move into those environments with very little effort.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Arkanix Stealer Attacking Users to Steal VPN Accounts, Screenshots and Wi-Fi Credentials appeared first on Cyber Security News.

Candiru, an Israeli-based spyware vendor, has deployed sophisticated malware infrastructure across multiple countries to target high-value individuals including politicians, journalists, and business leaders.

The mercenary spyware, known as DevilsTongue, represents a growing threat to Windows users globally, with eight distinct operational clusters identified across Hungary, Saudi Arabia, Indonesia, and Azerbaijan.

This modular Windows malware combines advanced evasion techniques with extensive surveillance capabilities, making it one of the most dangerous cyber threats operating today.

DevilsTongue has emerged as a particularly concerning weapon in the mercenary spyware market, capitalizing on both advanced exploitation techniques and sophisticated persistence mechanisms.

The malware operates through multiple infection vectors, leveraging zero-day vulnerabilities in web browsers and weaponized documents to compromise target systems.

What makes this spyware distinctive is its ability to operate covertly once installed, stealing sensitive information while remaining virtually undetectable to standard security tools.

Recorded Future security analysts identified new infrastructure linked to Candiru’s operational clusters, revealing significant differences in how various groups manage their victim-facing systems.

Some clusters operate directly, while others route commands through intermediary layers or the Tor network, adding layers of complexity to defensive efforts.

The discovery highlights how Candiru continues adapting its operational security even after facing international sanctions from the US Department of Commerce in November 2021.

The licensing model for DevilsTongue underscores the commercial nature of this threat. According to leaked project proposals, Candiru charges based on concurrent infections, allowing customers to monitor multiple devices simultaneously.

A base contract starting at €16 million permits unlimited infection attempts with ten concurrent devices monitored, while additional fees unlock expanded capacity and geographic coverage across different countries.

This pricing structure attracts government clients with substantial budgets seeking persistent surveillance capabilities.

Technical Persistence and Evasion Mechanisms

DevilsTongue employs sophisticated techniques to maintain persistence and evade detection on infected Windows systems.

The malware utilizes COM hijacking by overwriting legitimate COM class registry keys, directing them toward a first-stage DLL located in C:\Windows\system32\IME.

This approach cleverly disguises the malware within legitimate system directories. A signed third-party driver called physmem.sys enables kernel-level memory access, allowing the malware to proxy API calls and avoid detection mechanisms.

During the hijacking process, DevilsTongue reinstates the original COM DLL through shellcode manipulation of the LoadLibraryExW return value, maintaining system stability to prevent triggering security alerts.

All additional payloads remain encrypted and execute exclusively in memory, preventing forensic recovery.

This design allows the malware to extract credentials from LSASS, browsers, and messaging applications like Signal Messenger before covering its tracks through metadata scrubbing and unique file hashing.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Candiru’s DevilsTongue Spyware Attacking Windows Users in Multiple Countries appeared first on Cyber Security News.