11,000 Android Devices Hacked by Chinese Threats Actors to Deploy PlayPraetor Malware

PlayPraetor is a sophisticated Android Remote Access Trojan deployed via fake Google Play pages that has infected over 11,000 devices and is expanding rapidly (~2,000 new infections/week). The malware abuses Android Accessibility Services to perform real-time fraudulent transactions against ~200 banking and crypto wallet apps, uses a three-tier C2 architecture (HTTP/HTTPS endpoints, persistent WebSocket on port 8282, and RTMP on port 1935), and is operated through a Chinese-language, multi-tenant control panel with major impact in Europe (58%) and notable presence in Africa, the Americas, and Asia.