Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Beware of Bad Pack: One Weird Trick Being Used Against Android Devices

Summary: Unit 42 examined BadPack Android malware, which tampers with ZIP header fields in APK files so that the local file header and central directory file header disagree, causing tools like Apktool and Jadx to fail to extract AndroidManifest.xml. Reviewing Advanced WildFire telemetry from June 2023 through June 2024, Unit 42 found almost 9,200 matching BadPack samples, and banking Trojans including BianLian, Cerberus and TeaBot use the technique.

What you should know: The Android runtime reads only the central directory header and infers missing values, so a BadPack APK installs and runs on a device while the same file defeats the static analysis pipeline your team relies on - nearly 9,200 samples in a single year is the scale of that blind spot.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related