Fakecalls Android Malware Abuses Legitimate Signing Key

McAfee Mobile Research describes an Android banking trojan campaign (Fakecalls) that used a leaked legitimate signing key and packer to evade detection; the dropper installs a malicious APK disguised as an HTML asset, requests broad permissions, registers services and receivers, and connects to remote C2 infrastructure via a push SDK to exfiltrate SMS, contacts, call records, files and to control infected devices. The report includes technical details, a command list, multiple SHA256 indicators, and domains associated with the campaign.