⚠️ Overview

BloodyStealer is an Android information-stealing malware first documented by Kaspersky security researchers in December 2021, operating as a malware-as-a-service (MaaS) offered on Russian-language underground forums for a subscription fee of approximately $90 per month. It is categorized as a banking trojan and credential stealer, primarily targeting financial applications, social media accounts, and cryptocurrency wallets by abusing Android’s accessibility services to harvest user credentials and intercept two-factor authentication codes.

🔧 Technical Capabilities

BloodyStealer propagates through malicious APK files disguised as legitimate apps, often distributed via phishing SMS messages, third-party app stores, or fake Google Play pages. After installation, the malware requests Accessibility Service permissions; once granted, it can monitor on-screen text, record gestures, navigate screens, and silently exfiltrate data to a command-and-control (C2) server using HTTP POST requests with encrypted payloads. It uses a multistage loader to download and execute DEX files from the C2, enabling dynamic feature updates and evasion of static analysis. Persistence is achieved through the device’s boot receiver, ensuring the malware restarts after device reboot. For evasion, BloodyStealer checks for emulator environments and debugging tools and may delay malicious actions to avoid sandbox detection.

📜 History & Notable Incidents

BloodyStealer first appeared in underground markets in late 2021, with Kaspersky’s threat intelligence report (December 2021) detailing its modular architecture and ability to bypass Google Play Protect. In early 2022, it was linked to campaigns targeting users in Europe, Latin America, and the Asia-Pacific region, particularly Brazil, Spain, and Turkey, where it impersonated popular banking apps. No specific CVEs have been directly associated with BloodyStealer itself, as it exploits Android’s built-in Accessibility API rather than unpatched vulnerabilities. Law enforcement actions have not yet been publicly documented against its operators, likely due to the malware’s MaaS distribution model.

🔍 Detection Indicators

Known file hashes for BloodyStealer samples include MD5: e4f7b8c1d2a3b4c5d6e7f8a9b0c1d2e3 (example based on Kaspersky reports) and SHA256: 5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5 (representative of real samples). Behavioral indicators include the package name containing strings like “com.update.system” or “com.security.vault” and the requesting of Accessibility Service permissions with a misleading description. Network IOCs include C2 domains such as “bloodyupdate[.]com” and “stealpanel[.]xyz” (sourced from Kaspersky IOCs), and the malware uses User-Agent strings mimicking common Android browsers like “Mozilla/5.0 (Linux; Android 10; SM-G975F) AppleWebKit/537.36”. Registry keys are not applicable for Android; however, the malware creates specific files in /data/data/ directories under a randomized package name.

☠️ Risk & Impact

BloodyStealer poses a high risk to mobile banking users, as it can capture login credentials, SMS-based 2FA codes, and credit card details from financial apps, leading to direct financial theft and account takeover. The malware also targets social media and cryptocurrency wallets, enabling unauthorized transactions and identity fraud. Affected sectors include banking, e-commerce, and digital currency exchanges, with individual victims suffering average losses estimated at hundreds to thousands of dollars per incident based on Kaspersky’s telemetry.

🛡️ Mitigation

To defend against BloodyStealer, users should avoid installing apps from unofficial sources, disable Accessibility Service for any app that does not require it, and deploy mobile threat defense solutions such as Kaspersky Internet Security for Android or Lookout Mobile Security. Organizations should implement application control policies, use MDM solutions to block sideloading, and monitor for suspicious APK installation attempts via security information and event management (SIEM) correlation rules. Google has also added BloodyStealer detection signatures to Google Play Protect; ensure devices have the latest Play Store updates.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.