NEW HERODOTUS ANDROID MALWARE FAKES HUMAN TYPING TO AVOID DETECTION

Summary from the TLDR InfoSec newsletter

Threat Fabric has detected a new Android malware-as-a-service (MaaS) dubbed Herodotus that is being used in campaigns targeting Italian and Brazilian users through smishing. The malware uses a novel randomized delay of 0.3 to 3 seconds when typing to mimic human typing and evade behavioral detections. Herodotus also provides clients with a control panel to customize the SMS message, as well as the ability to overlay pages mimicking banking and crypto pages to steal credentials, overlay opaque pages to hide malicious behavior, an SMS stealer for MFA interception, and screen recording.