New Sneaky Xamalicious Android Malware Hits Over 327,000 Devices

McAfee researchers identified an Android backdoor named Xamalicious, built with the Xamarin framework and abusing Android accessibility permissions to perform ad-fraud, app installs, click automation and to fetch a second-stage assembly DLL for full device control; 25 malicious apps (some previously on Google Play) are linked to the family with an estimated 327,000 installs across multiple countries. The report also describes a concurrent phishing campaign targeting Indian banking users via WhatsApp-distributed fake APKs that request SMS permissions and harvest banking credentials, cards, national ID data and intercepted SMS messages for unauthorized transactions.