Rootnik Android Trojan Abuses Commercial Rooting Tool and Steals Private Information
Summary: Unit 42 analyzed an Android Trojan called Rootnik that repackages a Chinese commercial rooting tool, Root Assistant, to steal at least five exploits granting root access on devices running Android 4.3 and earlier. The malware spreads through repackaged legitimate apps, with more than 600 samples observed affecting users in the United States, Malaysia, Thailand, Lebanon and Taiwan, and writes four APK files to the system partition that promote apps, act as a remote control, and harvest WiFi, location and other private data.
What you should know: Rootnik's remote control component can silently install and uninstall apps and execute new code from servers that were still active at publication, and its data-harvesting APK has no icon on the device - so users and standard app inventories have nothing to notice.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026