Mysterious family of malware hid in Google Play for years

A family of Android malware known as Mandrake has been discovered in Google Play after evading detection for years. Initially identified by Bitdefender in 2020, Mandrake was found hidden in apps masquerading as file-sharing, astronomy, and cryptocurrency tools. These apps were present in two waves, from 2016 to 2017 and again from 2018 to 2020, with an estimated tens of thousands of victims during the latter period. Following Bitdefender's report, the malware seemed to disappear but resurfaced in 2022, remaining undetected until recently. Kaspersky researchers noted that the latest Mandrake variants employed advanced obfuscation techniques to evade analysis and detection, including moving malicious code to native libraries and using a kill switch to erase traces of the malware.

Mandrake's primary functions include stealing user credentials and executing further malicious applications, typically targeting a small number of carefully selected victims. The malware can record screens and capture user inputs through commands sent from a control server. Kaspersky identified several apps associated with Mandrake, which were removed from Google Play after their discovery. The ongoing evolution of Mandrake highlights the challenges in detecting sophisticated malware, even with improved app vetting processes in official marketplaces.