APK Malformation Found in Thousands of Android Malware Samples

Cleafy researchers reported a widespread Android malware evasion technique—APK malformation—found in over 3,000 samples across families including Teabot, TrickMo, Godfather, and SpyNote; attackers deliberately create inconsistent ZIP/APK structures (directory-file collisions, unsupported compression, mismatched headers, manifest corruption, and filenames with non‑ASCII/control characters) that crash static analysis tools while still installing on devices, and Cleafy released Malfixer to detect and repair these malformed APKs to aid analysis.