New Variant of FakeCop Targeting Users from Japan

Cyble Research Labs discovered a FakeCop Android spyware campaign targeting users in Japan: malicious APKs impersonate legitimate security/anti-virus apps, use a native .so-based packer to decrypt an embedded DEX at runtime, and perform spyware actions (collect contacts/SMS/app lists, retrieve hardware IDs, send/delete SMS) while contacting C2 servers obtained via a proxy URL; the report provides multiple SHA256 IOCs and C2/proxy URLs.