AntiDot Android Banking Trojan: Threat to Egyptian Banking Customers

Coming soon. This write-up is still being written. Check back shortly; it will be published at this same address.

Unpacking an Android banker down to its payload: Accessibility and overlay abuse, OTP theft and what banks can detect.

What it will cover

• The native-backed packer and how the hidden DEX was recovered
• Abuse of Accessibility services, overlays, the default SMS role and screen capture
• C2 and the target-app list, mapped to ATT&CK for Mobile
• Detections and recommendations for banks

Meanwhile

• The case file in my portfolio: https://artfuldodger10.github.io/portfolio/#/case/antidot
• The code, detections and IOCs: antidot-android-banker