The Mobile Malware Chronicles: Necro.N

**Executive Summary:** zLabs tracked the Necro.N mobile malware campaign (37 samples) that uses a malicious advertising SDK embedding native libraries (libcoral.so, libsvm.so) which contact a C2 to retrieve steganographically-hidden DEX payloads; the malware can install apps, execute JS in invisible WebViews to subscribe victims to paid services, persist via boot receivers, access notifications and device identifiers, and shows low detection rates for some samples, indicating an active, evasive threat.