Unmasking SpyAgent: Zimperium’s Zero-Day Defense Against Cryptocurrency Theft

The report describes a sophisticated Android spyware campaign named SpyAgent that leverages accessibility services and image-recognition/OCR to take screenshots of transaction/login flows, extract cryptocurrency credentials (private keys, logins) and exfiltrate them to attacker-controlled C2 servers; Zimperium and other mobile security vendors claim zero-day detection and on-device classifier protection against these variants.