Fake AV Investigation Unearths Kev Droid, New Android Malware
Summary: Cisco Talos identified two variants of an Android remote administration tool it named KevDroid, which steals contacts, SMS and phone history and records victim calls, sending the data via HTTP POST to a command and control server. One variant carries an embedded ELF file named "POC" that exploits CVE-2015-3636 to gain root on the device, and the same C2 server hosted a Windows RAT named PubNubRAT that uses the PubNub data stream network to send commands.
What's compelling: The stolen data set includes SMS, which the source notes can enable multi-factor token access, alongside banking information and corporate email on devices many users connect to work. Talos also states it could not establish a link between these samples and Group 123, describing only tactics too weak to confirm a real connection.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2015-3636
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026