MoqHao Android Malware Evolves with Auto-Execution Capability

**Executive summary:** The report describes a new auto-executing Android malware variant dubbed MoqHao (aka Wroba/XLoader) distributed via smishing that automatically runs after install, requests risky permissions, and harvests device metadata, contacts, SMS, photos and more; it also covers Bigpanzi, a long-running campaign that infects Android-based smart TVs and set-top boxes to build a large botnet used for DDoS, proxying and illicit streaming, with evidence of substantial scale across multiple countries.