Rapid Response: Zimperium Detects Lazarus Stealer Campaign with Full Coverage and Additional Samples

Lazarus Stealer is an Android banking trojan masquerading as a legitimate utility (GiftFlipSoft) that hides from the user interface, abuses intrusive permissions (SMS default role, overlay, usage access) to intercept OTPs and monitor apps, dynamically loads phishing overlays via WebView, and persistently exfiltrates credentials to C2 servers; the report identifies 46 related samples and publishes IOCs while noting detection by mobile security products.