Android spyware 'Mandrake' hidden in apps on Google Play since 2022

A new, heavily obfuscated variant of the Android spyware 'Mandrake' was found embedded in five Google Play apps (notably AirFS) downloaded ~32,000 times across multiple countries; the malware uses native libraries (libopencv_dnn.so and libopencv_java3.so), multi-stage in-memory DEX loading, OLLVM obfuscation, certificate-based C2, and a broad spying feature set (data collection, screen recording, remote command execution, UI simulation, and prompting installs). Kaspersky documented the apps, removal from the Play Store by March 2024, and recommended defenses (install from reputable publishers, check permissions/comments, keep Play Protect enabled) while warning the threat could return via new droppers.