Mobile malware continues to evolve, posing a persistent and often underestimated threat to users worldwide. In this session, we present key findings from a series of malware investigations conducted over the past two years, offering a comprehensive look into the current state of mobile malware and its implications for users and institutions alike.
We begin by exploring the broader mobile threat landscape—highlighting prevalent malware capabilities, global distribution trends, and the challenges in attributing these campaigns to specific threat actors. The talk then focuses on a detailed case study of a sophisticated malware campaign that leverages social engineering and impersonates legitimate Android applications to compromise user devices.
The attack is broken down into three critical phases: Delivery, Enablement, and Exploitation. We demonstrate how attackers manipulate users into granting dangerous permissions—particularly Android Accessibility Services—ultimately gaining full control of the device. Our reverse engineering reveals the malware to be a repackaged variant of the Gigabud Remote Access Trojan (RAT), previously seen in campaigns impersonating government services. We will also cover a few reactive strategies that the threat actors adopted in response to improved detection, and how their delivery methods changed in response.

While this malware is not specifically designed to target South African institutions, the tactics and methods employed by threat actors enable them to manipulate users into granting access to their financial applications. This underscores the importance of practical mitigation strategies, such as user education, understanding Google Play Protect’s behaviour, and fostering collaboration among financial institutions to strengthen detection and response efforts.
This talk aims to demystify the mobile malware ecosystem, assess the real-world risks to users, and highlight actionable steps that can be taken to disrupt these evolving threats.