Rapid Response: Zimperium Secures Mobile Endpoints Against Octagon Android Malware

Zimperium and K7 Security describe "Octagon", a sophisticated multi-stage Android RAT masquerading as Bahrain's "BH Alert" app. Octagon extracts an encrypted payload (disguised as a font), decrypts it (RC4-based) and dynamically loads code via DexClassLoader, abuses Accessibility services to capture keystrokes and UI data, and attempts VPN hijacking to inspect and redirect network traffic; Zimperium reports on-device, ML-driven detection and prevention of the threat prior to public IOC disclosure.