Zimperium Discovers MobOk Malware Left Undetected by AV Industry for Months

Zimperium zLabs reports on evolved MobOk Android malware variants distributed (including via Google Play) that hide malicious code with the Tencent packer and native libraries, steal SMS for 2FA bypass, abuse Accessibility Services to automate UI interactions and install companion apps, bypass image CAPTCHAs via external recognition services, subscribe victims to premium services, and provide detailed IOCs (file hashes and C2 URLs).