VexTrio TDS System Developing Several Malicious Apps Mimic as VPNs to Publish in Google Play and App Store

VexTrio, a long-standing cybercriminal traffic distribution system, has expanded from web-based scams into distributing malicious mobile apps via app stores that masquerade as VPNs and system utilities; these apps perform user profiling, communicate with C2 using encrypted channels, employ obfuscation and anti-analysis checks, and deliver notification-hijacked fraudulent ads and scams integrated with VexTrio's TDS.