A sophisticated Android remote access trojan (RAT) has emerged on GitHub, presenting significant security concerns for mobile device users worldwide.

The malware, publicly available under the repository “Android-RAT” by user Huckel789, claims to offer fully undetectable (FUD) capabilities that can bypass modern security measures and antivirus detection systems.

This malicious software represents a concerning evolution in mobile malware distribution, leveraging legitimate platforms to host and distribute dangerous payloads.

The RAT operates through a web-based interface requiring no PC installation, making it accessible to threat actors with varying technical expertise.

Its distribution method exploits GitHub’s trusted platform status, potentially bypassing security filters that typically block malicious downloads from suspicious domains.

The malware’s comprehensive feature set includes keylogging capabilities, credential hijacking, ransomware functionality, and sophisticated social engineering tools designed to deceive users into granting necessary permissions.

Security researcher Huckel789 identified this particular strain as employing advanced stealth techniques specifically engineered to evade detection by popular antivirus solutions and VirusTotal scans.

The malware incorporates anti-emulator and virtual machine detection mechanisms, ensuring it operates exclusively on genuine Android devices while remaining dormant in security analysis environments.

This selective activation approach significantly complicates traditional malware analysis workflows used by security professionals.

The Android RAT demonstrates remarkable persistence capabilities, surviving ultra battery optimization modes and various power management restrictions commonly found in Chinese ROM implementations like MIUI.

Its resource-efficient design enables continuous background operation while consuming minimal system resources, making detection through performance monitoring extremely difficult.

Advanced Evasion and Communication Architecture

The malware’s communication infrastructure represents a sophisticated approach to command and control operations.

Unlike conventional RATs that employ simple base64 encoding for server communications, this variant implements AES-128-CBC encryption with PKCS padding to secure all data transmissions between infected devices and command servers.

The encryption implementation ensures that network traffic analysis cannot easily reveal malicious communications, while advanced obfuscation techniques protect the embedded server IP addresses from discovery through static code analysis.

The RAT’s “Freeze Mode” functionality demonstrates particular innovation in stealth operations, limiting data transmission to 1-3MB over 24-hour periods while maintaining responsiveness to operator commands.

This approach minimizes network signatures that could trigger security monitoring systems while ensuring reliable remote access capabilities.

The malware can inject its payload into legitimate applications through a sophisticated dropper module, making initial infection vectors extremely difficult to identify through conventional security scanning mechanisms.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Fully Undetectable FUD Android RAT Hosted on GitHub appeared first on Cyber Security News.

In recent weeks, security teams have observed a surge in malvertising campaigns distributing what appears to be a fully functional PDF editor.

Dubbed TamperedChef, this malware masquerades as a legitimate application—AppSuite PDF Editor—leveraging convincing advertisements to lure European organizations and individuals into downloading the installer.

Once executed, the installer exhibits expected functionalities for nearly two months, during which victims remain unaware of its true nature.

During installation, users encounter a professional end-user license agreement dialogue consistent with mainstream software offerings.

This dialog, displayed in multiple languages, reinforces the illusion of legitimacy and bypasses automated sandbox detonations.

Clicking Accept and Install allows the MSI package to proceed without requiring administrative privileges, making it particularly effective in corporate environments with restricted user rights.

WithSecure Labs analysts identified TamperedChef following a sudden spike in credential-theft incidents within enterprise environments.

Telemetry data revealed that, upon activation, the malware’s hidden payload initiates the systematic harvesting of browser-stored usernames and passwords.

This exfiltration occurs silently, with stolen credentials transmitted to attacker-controlled infrastructure, paving the way for backdoor access and further lateral movement.

Once the malicious payload embedded within pdfeditor.js activates, the application transitions from a benign editor to a stealthy credential harvester.

The attack is orchestrated using a custom NodeJS module—Utilityaddon.node—which interacts with native Windows APIs to manipulate registry entries and scheduled tasks for persistence.

By inserting autorun registry keys under the current user hive, the malware ensures execution at each logon without elevating privileges.

Infection Mechanism

The infection begins when a user clicks a malicious advertisement and downloads the AppSuite PDF Editor installer from vault.appsuites.ai.

This installer, created with the Nullsoft Scriptable Install System (NSIS), unpacks the Electron-based application under the user’s profile directory.

The primary executable, PDF Editor.exe, launches a Chromium-based interface that loads additional JavaScript modules from remote servers.

Before any PDF editing functionality is available, the installer sets persistence via an autorun registry entry named PDFEditorAutoUp that points to the installed application.

At runtime, the obfuscated pdfeditor.js script checks for command-line switches, notably --cm, which triggers malicious routines:-

if (app.commandLine.hasSwitch('cm')) {
  utilityAddon.setupTasks(globals.scheduledTaskName);
  startCredentialHarvest();
}

By using command-line flags, the threat actors can toggle between benign and malicious behaviors, complicating detection.

Once the script executes startCredentialHarvest(), it scans local browser storage for credentials and dispatches them over HTTPS to attacker-controlled endpoints, while the visible PDF editor interface remains functional to avoid arousing suspicion.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post TamperedChef Malware as PDF Editor Harvest Browser Credentials and Allows Backdoor Access appeared first on Cyber Security News.