CapraRAT Spyware Disguised as Popular Apps Threatens Android Users

SentinelOne reports that the APT actor Transparent Tribe is continuing the CapraTube campaign, distributing CapraRAT spyware through malicious Android APKs (e.g., com.maeps.crygms.tktols, com.nobra.crygms.tktols) that masquerade as video, gaming, and weapons-related apps to surveil targets by exfiltrating SMS, contacts, location, call logs, and capturing audio/video; the article also notes Promon’s disclosure of Snowblind, a sophisticated Android banking malware leveraging seccomp and accessibility abuses to bypass protections and steal credentials.