Mobile Malware Analysis Part 8 deVixor Android Banking Troja...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://8ksec.io/mobile-malware-analysis-part-8-devixor
• Blog Title: Mobile Malware Analysis Part 8: deVixor Android Banking Trojan
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse and Webview Attacks; optionally Basic Forensic Methodology > Malware Analysis / Android Malware Post-Exploitation for the R8 deobfuscation workflow

🎯 Content Summary

Overview and severity

The post reverse-engineers deVixor v2.3.0, an Android banking trojan, remote-access trojan, and ransomware family targeting Iranian users and financial institutions. The sample combines credential interception inside legitimate banking websites, SMS and OTP theft, Accessibility-based keylogging and notification capture, anti-uninstall controls, shutdown interference, file and photograph collection, remote command execution, and a blocking cr...

🔧 Technical Details

Credential interception in an attacker-controlled WebView: An Android application can load a legitimate HTTPS login portal in a JavaScript-enabled WebView while retaining control over the page DOM. A malicious WebViewClient injects JavaScript from onPageFinished(), locates username, password, and submit elements through target-specific CSS selectors, and attaches a listener to the login button. The listener reads the values and passes them to native code through an object registered with addJavascriptInterface, such as Android.onLoginClicked(username, password). Native code can tag the credentials with a target identifier, serialize them, and exfiltrate them asynchronously. The page and TLS connection may be legitimate; the malicious component is the application-controlled browser container.

Modular Accessibility abuse: A malicious Accessibility service can dispatch every event to indepe...

🤖 Agent Actions

Plan: inspect the Android/mobile and malware-analysis documentation, compare at least five relevant pages for overlap and style, verify the source and any primary Android documentation needed, make one focused update, then review the diff and Markdown/reference integrity.
I found dedicated pages for WebView attacks, Accessibility abuse, manual Android deobfuscation, APK decompilation, and Android malware post-exploitation. I’ll now compare these pages for existing coverage and reference conventions before choosing a single target file.
The existing Accessibility page already covers keylogging, notification theft, overlays, gesture automation, and no-root abuse. The deobfuscation pages already cover jadx/apktool and obfuscated-call tracing broadly. The clearest non-duplicative addition is therefore the malicious-container pattern: selector-based credential interception from a legitimate HTTPS page inside an attacker-owned WebView. I’ll verify the original article and Android bridge behavior, then add only that technique to webview-attacks.md.
Source verification confirms Cyble first documented the family-level WebView credential-harvesting behavior, while 8kSec later recovered the selector configuration, onPageFinished() injection, bridge method, and dynamic-form retry logic. I’ll credit both in that order and keep the addition generic rather than documenting sample-specific IOCs.
The first review passes git diff --check. I’m tightening the example so its placeholders are syntactically explicit and removing an unsourced alternative hook mechanism, then I’ll run citation/reference checks and the available book validation.
Updated src/mobile-pentesting/android-app-pentesting/webview-attacks.md.

Added:

• Attacker-controlled WebView credential interception technique.
• Selector-based Kotlin/JavaScript skeleton.
• Dynamic-form polling and selector fragility notes.
• Static-analysis hunting indicators.
• Numbered citations to the original Cyble research and 8kSec analysis.

Validation passed:

• git diff --check
• Reference numbering and citation checks
• Balanced code fences and <details> tags
• Forbidden-source check

mdbook was not installed, so a full book build was unavailable.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://8ksec.io/mobile-malware-analysis-part-8-devixor

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse and Webview Attacks; optionally Basic Forensic Methodology > Malware Analysis / Android Malware Post-Exploitation for the R8 deobfuscation workflow".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0