GPlayed Trojan - .Net playing with Google Market
Summary: Cisco Talos identified a new Android trojan it named GPlayed, disguised with a Google Apps-like icon and the label "Google Play Marketplace," written in .NET using Xamarin with a main DLL called "Reznov.DLL" containing the core "eClient" class. The trojan declares the BIND_DEVICE_ADMIN permission, pings its C2 every 20 seconds, forwards all SMS contents and senders, and can remotely load plugins or compile new .NET code on the device at runtime.
Bottom line: The sample was targeted at Russian-speaking users and appears to be in testing, but its modular design lets operators add capabilities without recompiling the package - and its credit-card phishing WebView cannot be dismissed until payment details are entered.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026