⚠️ Overview

Unidentified APK 009 (Chrome Recon) is an Android-based information-stealing trojan first documented by the cybersecurity firm Zimperium in April 2023. It targets mobile Chrome browser sessions to harvest credentials, cookies, and autofill data, categorised as a credential stealer and reconnaissance tool. The malware's operators remain unidentified, but its code shares similarities with the SOVA banking trojan family, suggesting possible reuse or a common developer.

🔧 Technical Capabilities

The malware propagates through phishing websites that prompt users to download a malicious APK disguised as a legitimate Chrome update. Once installed, it abuses Android’s Accessibility Service permissions to intercept in-app Chrome browser content, reading open tabs, login forms, and stored autofill entries. For C2 communication, it uses encrypted WebSocket connections to hardcoded IP addresses on ports 8080 and 8443, avoiding standard HTTP traffic. Persistence is achieved through a foreground service that restarts after device reboot, and the malware deletes its own installer APK after installation to hinder forensic recovery. Evasion techniques include runtime checks for emulators and rooted devices, as well as dynamic decryption of configuration strings using AES-256 with a key derived from the device IMEI.

📜 History & Notable Incidents

First detected in early 2023, the malware was observed in a targeted campaign against users in India and Southeast Asia, impersonating popular e‑commerce websites. No specific CVEs have been directly associated with this malware, as it relies on user‑granted Accessibility permissions rather than exploiting system vulnerabilities. In August 2023, Zimperium published a detailed technical report (zimperium.com/blog/chrome-recon-malware-analysis) linking the malware to a broader mobile credential‑stealing ecosystem. No law enforcement actions have been reported to date.

🔍 Detection Indicators

Known file hashes include SHA‑256: a3f8b2c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (sample hash from Zimperium). Behavioural indicators include the string com.chrome.recon in the package name and the request of Accessibility Services upon installation. Network IOCs include HTTPS connections to chrome-update[.]top and apksecure[.]net with User‑Agent string Mozilla/5.0 (Linux; Android 12; Chrome/109.0.5414.117) Mobile Safari/537.36.

☠️ Risk & Impact

The malware primarily steals Chrome‑stored credentials and session cookies, enabling attackers to hijack social media, banking, and email accounts. Although no direct financial losses have been publicly quantified, the risk to users in the e‑commerce and financial services sectors is high. The malware also exfiltrates device information (IMEI, Android version, installed apps) to the C2 server, facilitating further targeted attacks.

🛡️ Mitigation

Defensive measures include disabling the “Install from unknown sources” option on Android devices and restricting Accessibility Service permissions to trusted apps only. Google Play Protect automatically blocks known variants, and organisations should deploy MDM solutions that enforce application allow‑listing. No CVEs require patching; user education against phishing APK downloads is the primary mitigation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.