Cleafy LABS

Technical threat intelligence, malware research, and security insights directly from Cleafy's analysts.

[Cleafy LABS @cleafylabs]

[4/4] Our full technical analysis is available here 👇
https://t.co/ze0663NBYd

[Cleafy LABS @cleafylabs]

[1/4]🚨 DevilNFC & NFCMultiPay: two new Android NFC relay malware families actively hitting European and LATAM banking customers. Developed independently by Spanish-speaking and Portuguese (Brazilian) TAs. The Chinese monopoly on NFC relay tooling is over.

[Cleafy LABS @cleafylabs]

[3/4] DevilNFC's standout: a single Dual-Role APK with a passive reader on the victim's device and a full system-level card emulator on the attacker's rooted hardware via Xposed Framework hooking into the Android NFC daemon.

[Cleafy LABS @cleafylabs]

[4/4] Our full technical analysis is available here 👇 https://t.co/ZLfjXTD3cn
Malfixer open-source on GitHub 👇 https://t.co/G4bSCZZQo2

[Cleafy LABS @cleafylabs]

[1/4]🚨 APK Malformation is no longer a niche evasion tactic; it is now a standard in the Android MaaS ecosystem. Observed in 3,000+ samples across families like TeaBot, TrickMo, and SpyNote, it keeps malware fully functional while blinding static analysis tools.

[Cleafy LABS @cleafylabs]

[3/4] To counter this, we're open-sourcing Malfixer, presented today at @Botconf 2026. Built over 2 years, it detects and surgically repairs all three malformation categories, rebuilding clean APKs ready for standard pipelines, without altering the payload.

[Cleafy LABS @cleafylabs]

[4/4] Our full technical analysis is available here 👇
https://t.co/5LNJhQAAFe

[Cleafy LABS @cleafylabs]

[1/4] 🚨 We tracked Mirax, a new Android RAT and banking malware operating as a private MaaS. First promoted on underground forums in December 2025, it's been actively targeting Spanish-speaking countries through Meta ad campaigns, reaching over 200,000 accounts.

[Cleafy LABS @cleafylabs]

[3/4] Beyond standard Android RAT capabilities, Mirax introduces an interesting feature: SOCKS5 proxy via Yamux multiplexing. Infected devices become proxy nodes, enabling attackers to mask malicious traffic behind legitimate IPs, even when full RAT infection fails.

[Cleafy LABS @cleafylabs]

(7/7) IOCs:
🔹 Dropper MD5: 612e1e4cef13c5c1f5f155d5b1a73016 🔹 Payload MD5 (TeaBot): 574742ad9a1eb519fce8b7c2b8795677
🔹 Play Store: hxxps://play.google[.]com/store/apps/details?id=com.backforge.olimpic.axiomdrivecenter

[Cleafy LABS @cleafylabs]

🚨 (1/7) Guess who's back? We identified a new dropper associated with the TeaBot banking trojan within the Google Play Store, with over 100K downloads. The malicious app masquerades as a PDF reader/file manager and has been active from 12th to 19th February 2026.

[Cleafy LABS @cleafylabs]

(6/7) Following our analysis, the Cleafy Labs team responsibly disclosed all findings to Google. The application was removed from the Play Store on February 19, 2026. We thank Google for the prompt action taken following our report.

[Cleafy LABS @cleafylabs]

[4/4] Our technical analysis is available here 👇
https://t.co/XYH4dhVWx5

[Cleafy LABS @cleafylabs]

[1/4] 🚨 We tracked Albiriox, a newly identified Android malware family offered as a Malware-as-a-Service (MaaS). Hardcoded targets indicate a broad target spectrum, encompassing major banking and cryptocurrency applications worldwide.

[Cleafy LABS @cleafylabs]

[3/4] Albiriox exhibits the core features of modern Android Banking Trojans, enabling TAs to perform On-Device Fraud (ODF) through remote control, screen manipulation, and real-time interaction with the infected device.