Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps

Octagon is an Android on-device fraud bot offered as a malware-as-a-service by the Russian-speaking actor AndroidKitKat; the report documents its accessibility-abuse overlays, hidden remote control (VNC), SMS/OTP interception, unlock-pattern capture, balance-reading, persistence mechanisms, and sideload delivery. Analysts recovered three related APKs with shared identifiers (com.kisa.octagonpanel, default C2 key, port 4444), listed C2 IPs and signer hashes, and linked a separate Bahrain-themed BH Alert campaign that used similar artifacts; recommended detection focuses on installation/permission flows, encrypted TCP control on port 4444, and shared client identifiers.