MITRE ATT&CKsoftware (malware)

S1214 Android/SpyAgent

Published 2025-03-24 Modified 2025-03-27 Official page ↗
Domain
mobile
Platforms
Android
Version
1.0
Created
2025-03-24

Description

Android/SpyAgent is a variant of spyware in the MoqHao phishing campaign primarily targeting Korean and Japanese users. Fake security applications were used to target Japanese users, while fake police applications were used to target Korean users. Both fake applications have common C2 commands and share the same crash report key on a cloud service.

Related

Uses · MITRE ATT&CK (8)

  • T1655.001 Match Legitimate Name or Location sub-technique
  • T1481.001 Dead Drop Resolver sub-technique
  • T1629.003 Disable or Modify Tools sub-technique
  • T1636.004 SMS Messages sub-technique
  • T1616 Call Control technique
  • T1481 Web Service technique
  • T1406 Obfuscated Files or Information technique
  • T1422 System Network Configuration Discovery technique

References