Android Marcher now marching via porn sites

This report analyzes a recent wave of the Android Marcher Trojan distributing AdobeFlashPlayer.apk via pornographic and other malicious sites; once installed (it requests device admin), Marcher reports installed packages to C2, displays fake Google Play payment screens and targeted banking overlays to steal financial credentials, and exfiltrates data to identified C2 URLs. The document provides technical details of the infection flow, affected banking apps, screenshots of behavior, and a list of IOCs for detection and mitigation.