Fake App Attack Targets Japanese Telecom Users

Cyble Research Labs analyzed an Android malware campaign that impersonates a major Japanese telecom app to phish users for their network PINs and credentials by loading the legitimate payment site in a WebView, injecting JavaScript to scrape credentials, capturing session cookies via the Cookie Manager API, and exfiltrating stolen data to the attacker via SMTP; the researchers recovered 2,900+ stolen credentials/cookies from the attacker's infrastructure and documented APK metadata, obfuscation/decryption routines, and IOCs.