Plugin Phantom: New Android Trojan Abuses “Droid Plugin” Framework
Summary: Unit 42 discovered a new Android Trojan, PluginPhantom, that steals files, location data, contacts and Wi-Fi information, takes pictures and screenshots, records audio, intercepts and sends SMS, and logs keyboard input via the Android accessibility service. It is the first Android Trojan to abuse the legitimate open source DroidPlugin framework, embedding nine plugin apps in a host app so malicious modules can be updated without reinstalling and hidden from static detection.
Key Takeaway: PluginPhantom shares a certificate and package name with Android.Trojan.Ihide and adds an update plugin that downloads new plugin APKs from the C2 server, so the malware on a device can change after installation without a new app ever being installed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026