'BadPack' APK Files Make Android Malware Hard to Detect

Unit 42 researchers disclosed "BadPack", a technique that maliciously manipulates ZIP header data in Android APKs to prevent static-analysis tools (e.g., Apktool, Jadx) from extracting AndroidManifest.xml and other content while still being tolerated by the Android runtime; this evasion has been observed in banking trojans such as TeaBot, BianLian, and Cerberus with about 9,200 BadPack samples detected. The report explains how BadPack works, why analysis tools fail, detection and remediation methods (including restoring header values and using APK Inspector), and recommends defensive measures such as avoiding third-party app sources and scrutinizing unusual permission requests.