Kwetza: Infecting Android Applications

This blog post demonstrates a practical method and an automation tool (Kwetza) for backdooring legitimate Android APKs by embedding an Android Meterpreter payload into target apps. It walks through generating the payload, consolidating payload code, identifying injection points via AndroidManifest and smali, injecting and rebuilding the APK, signing and installing it, and shows that the modified app can evade antivirus detection and provide persistent remote access using the app's existing permissions.