Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan for Android called Octagon is impersonating the official emergency alerts application from Bahrain to seize control of devices and exfiltrate sensitive information.
The attack starts when users download the file BH-Alert.apk from phishing pages. The application mimics legitimate services and walks victims through seven separate steps to obtain dangerous permissions. The first component stores part of its code in encrypted form inside a file that uses a font extension. This content is decrypted and loaded only during runtime, making static analysis significantly more difficult.
After initial execution, the malware installs a second application named OctagonPanel. Dedicated surveillance services continuously monitor one another and automatically restart any components that are killed. Boot receivers ensure the threat reactivates after the device is powered on.
Octagon further creates a fake account on the Android system and schedules synchronization tasks every 30 minutes. This mechanism wakes the malware, fetches updated configuration data, and re-establishes communication with the command-and-control server.
By abusing the Accessibility Service, the threat records PINs, passwords, and unlock patterns. The 200 most recent entries can remain stored on the device before being transmitted. The RAT also collects SMS messages, contacts, call logs, and screenshots while displaying fake overlay pages for other applications. A VPN controlled by the attackers can intercept or redirect the victim’s network traffic.
Related articles
Network Traffic Analysis Reveals 75% Malware Threats Over 10 Months of Monitoring
Positive Technologies analyzed anonymized data from PT Sandbox and PT Network Attack Discovery collected between October 2025 and July 2026. The study found that malicious software accounted for 75% of all detected threats in organizational network traffic. Information-stealing trojans made up 24% of malware samples, with 85% of those focused on credential theft. RATs, loaders, and ransomware each represented smaller but high-impact shares. Legacy vulnerabilities such as CVE-2017-0199 and CVE-2017-11882 remained active attack vectors. Activity from groups including MustangPanda, TA505, and APT37 was observed across finance, manufacturing, and government sectors.
HEAVYGRAM Spyware Uses Telegram Bots for Command and Control Against Iranian Targets
Researchers at Group-IB have published a detailed analysis of HEAVYGRAM, a spyware family that abuses the Telegram messaging platform as its command-and-control infrastructure. The malware family was first observed in the second half of 2023 and has since been linked with moderate confidence to the Handala Hack group. Instead of operating dedicated servers, the operators rely on Telegram bots, accounts, and groups to register infected hosts, receive commands, exfiltrate stolen data, and deliver additional payloads. Once active, HEAVYGRAM captures screenshots, records audio, harvests cached files, and steals data from Telegram Desktop installed on the victim machine. The campaign primarily targets Iranian journalists, dissidents, and individuals opposed to the Iranian government. Infection vectors include malicious files distributed via messengers, disguised as legitimate applications such as Pictory, KeePass, or Telegram-related tools, sometimes delivered as HTML applications or scripts.
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens in Brazil
Elastic Security Labs researchers have detailed the operations of the KREMLIN banking malware, tracked under the identifier REF9334, which targets Chrome and Edge browsers to harvest credentials and session tokens. The campaign focuses almost exclusively on Brazil, with 98 percent of the 1,515 identified infections located in the country and impersonating a dozen Brazilian banks. Infection begins with multi-stage JavaScript loaders disguised as banking documents, invoices, or corporate papers that require manual execution by the victim. The loaders then deploy C++ installers and malicious browser extensions that modify the Secure Preferences file, enable developer mode, and overwrite protection objects with forged metadata using a technique called Phantom Extension. Once active, the extension collects session tokens, cookies, sessionStorage and localStorage data, 15 days of browsing history, screenshots, open tab information, and full HTML of visited pages. The operation has run since May 2025 across seven distinct campaigns and began using Ethereum smart contracts for infrastructure on 19 May 2026.
Malicious Twitch Extension Steals OAuth Tokens from Nearly 31,000 Users
A browser extension posing as an enhancement for Twitch has been stealing OAuth authentication tokens from approximately 31,000 users across Chrome and Firefox. The extension, known as Twitch Enhanced Viewer or JeetBot, was discovered by researcher Kush Pandya of Socket. It promised 1080p streaming in restricted regions and an ad-free experience while covertly exfiltrating session tokens to attacker-controlled servers. The tokens were transmitted in plaintext via network-layer redirects, allowing full access to chat functions, private messages, and account settings. Both the Chrome version with around 30,000 installations since June 26, 2025, and the Firefox version with 604 users since July 7, 2025, remained available in official stores at the time of reporting. Users are advised to immediately disable the extension and revoke active Twitch sessions to invalidate stolen tokens.