mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
99 lines
5.4 KiB
Markdown
99 lines
5.4 KiB
Markdown
# Mobile Phishing & Malicious App Distribution (Android & iOS)
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|
||
|
||
> [!INFO]
|
||
> This page covers techniques used by threat actors to distribute **malicious Android APKs** and **iOS mobile-configuration profiles** through phishing (SEO, social engineering, fake stores, dating apps, etc.).
|
||
> The material is adapted from the SarangTrap campaign exposed by Zimperium zLabs (2025) and other public research.
|
||
|
||
## Attack Flow
|
||
|
||
1. **SEO/Phishing Infrastructure**
|
||
* Register dozens of look-alike domains (dating, cloud share, car service…).
|
||
– Use local language keywords and emojis in the `<title>` element to rank in Google.
|
||
– Host *both* Android (`.apk`) and iOS install instructions on the same landing page.
|
||
2. **First Stage Download**
|
||
* Android: direct link to an *unsigned* or “third-party store” APK.
|
||
* iOS: `itms-services://` or plain HTTPS link to a malicious **mobileconfig** profile (see below).
|
||
3. **Post-install Social Engineering**
|
||
* On first run the app asks for an **invitation / verification code** (exclusive access illusion).
|
||
* The code is **POSTed over HTTP** to the Command-and-Control (C2).
|
||
* C2 replies `{"success":true}` ➜ malware continues.
|
||
* Sandbox / AV dynamic analysis that never submits a valid code sees **no malicious behaviour** (evasion).
|
||
4. **Runtime Permission Abuse** (Android)
|
||
* Dangerous permissions are only requested **after positive C2 response**:
|
||
```xml
|
||
<uses-permission android:name="android.permission.READ_CONTACTS"/>
|
||
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
|
||
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
|
||
<!-- Older builds also asked for SMS permissions -->
|
||
```
|
||
* Recent variants **remove `<uses-permission>` for SMS from `AndroidManifest.xml`** but leave the Java/Kotlin code path that reads SMS through reflection ⇒ lowers static score while still functional on devices that grant the permission via `AppOps` abuse or old targets.
|
||
5. **Facade UI & Background Collection**
|
||
* App shows harmless views (SMS viewer, gallery picker) implemented locally.
|
||
* Meanwhile it exfiltrates:
|
||
- IMEI / IMSI, phone number
|
||
- Full `ContactsContract` dump (JSON array)
|
||
- JPEG/PNG from `/sdcard/DCIM` compressed with [Luban](https://github.com/Curzibn/Luban) to reduce size
|
||
- Optional SMS content (`content://sms`)
|
||
Payloads are **batch-zipped** and sent via `HTTP POST /upload.php`.
|
||
6. **iOS Delivery Technique**
|
||
* A single **mobile-configuration profile** can request `PayloadType=com.apple.sharedlicenses`, `com.apple.managedConfiguration` etc. to enroll the device in “MDM”-like supervision.
|
||
* Social-engineering instructions:
|
||
1. Open Settings ➜ *Profile downloaded*.
|
||
2. Tap *Install* three times (screenshots on the phishing page).
|
||
3. Trust the unsigned profile ➜ attacker gains *Contacts* & *Photo* entitlement without App Store review.
|
||
7. **Network Layer**
|
||
* Plain HTTP, often on port 80 with HOST header like `api.<phishingdomain>.com`.
|
||
* `User-Agent: Dalvik/2.1.0 (Linux; U; Android 13; Pixel 6 Build/TQ3A.230805.001)` (no TLS → easy to spot).
|
||
|
||
## Defensive Testing / Red-Team Tips
|
||
|
||
* **Dynamic Analysis Bypass** – During malware assessment, automate the invitation code phase with Frida/Objection to reach the malicious branch.
|
||
* **Manifest vs. Runtime Diff** – Compare `aapt dump permissions` with runtime `PackageManager#getRequestedPermissions()`; missing dangerous perms is a red flag.
|
||
* **Network Canary** – Configure `iptables -p tcp --dport 80 -j NFQUEUE` to detect unsolid POST bursts after code entry.
|
||
* **mobileconfig Inspection** – Use `security cms -D -i profile.mobileconfig` on macOS to list `PayloadContent` and spot excessive entitlements.
|
||
|
||
## Blue-Team Detection Ideas
|
||
|
||
* **Certificate Transparency / DNS Analytics** to catch sudden bursts of keyword-rich domains.
|
||
* **User-Agent & Path Regex**: `(?i)POST\s+/(check|upload)\.php` from Dalvik clients outside Google Play.
|
||
* **Invite-code Telemetry** – POST of 6–8 digit numeric codes shortly after APK install may indicate staging.
|
||
* **MobileConfig Signing** – Block unsigned configuration profiles via MDM policy.
|
||
|
||
## Useful Frida Snippet: Auto-Bypass Invitation Code
|
||
|
||
```python
|
||
# frida -U -f com.badapp.android -l bypass.js --no-pause
|
||
# Hook HttpURLConnection write to always return success
|
||
Java.perform(function() {
|
||
var URL = Java.use('java.net.URL');
|
||
URL.openConnection.implementation = function() {
|
||
var conn = this.openConnection();
|
||
var HttpURLConnection = Java.use('java.net.HttpURLConnection');
|
||
if (Java.cast(conn, HttpURLConnection)) {
|
||
conn.getResponseCode.implementation = function(){ return 200; };
|
||
conn.getInputStream.implementation = function(){
|
||
return Java.use('java.io.ByteArrayInputStream').$new("{\"success\":true}".getBytes());
|
||
};
|
||
}
|
||
return conn;
|
||
};
|
||
});
|
||
```
|
||
|
||
## Indicators (Generic)
|
||
|
||
```
|
||
/req/checkCode.php # invite code validation
|
||
/upload.php # batched ZIP exfiltration
|
||
LubanCompress 1.1.8 # "Luban" string inside classes.dex
|
||
```
|
||
|
||
## References
|
||
|
||
- [The Dark Side of Romance: SarangTrap Extortion Campaign](https://zimperium.com/blog/the-dark-side-of-romance-sarangtrap-extortion-campaign)
|
||
- [Luban – Android image compression library](https://github.com/Curzibn/Luban)
|
||
|
||
{{#include ../../banners/hacktricks-training.md}}
|