New RecruitRat, SaferRat, Astrinox, Massiv Android Malware Found Targeting 800 Apps

Zimperium zLabs reports four active Android malware families—RecruitRat, SaferRat, Astrinox, and Massiv—used in distinct phishing and smishing campaigns to target banking and cryptocurrency apps. These families employ overlay attacks, Accessibility Service abuse, SMS interception, keylogging, MediaProjection screen recording, and persistent WebSocket channels to capture credentials, OTPs, and other sensitive data, with RecruitRat storing hundreds of fake login pages to trigger when targeted apps are opened.