DocSwap Malware as Security Document Viewer Attacking Android Users Worldwide

DocSwap is a sophisticated Android malware campaign masquerading as a legitimate document viewer to trick users into installing it; after installation it requests extensive permissions, persists on devices, uses obfuscation and a delayed multi-stage dropper, connects to encrypted C2 servers, and exfiltrates device info, contacts and SMS—capable of intercepting authentication messages and undermining 2FA. Analysts reported infection spikes across Asia, Europe and North America and recommend removing suspicious document apps, running full device scans with reputable AV, enabling Google Play Protect, and avoiding apps from unknown sources.