ANDROID MALWARE FVNCBOT, SEEDSNATCHER, AND CLAYRAT GAIN STRONGER DATA THEFT FEATURES

Summary from the TLDR InfoSec newsletter

Researchers disclosed three Android malware families with enhanced capabilities: FvncBot targets Polish banking users with keylogging, web-inject attacks, and hidden VNC; SeedSnatcher steals cryptocurrency wallet seed phrases and 2FA codes via Telegram distribution; and an upgraded ClayRat enables full device takeover through accessibility services abuse. FvncBot uses the apk0day crypting service and session-based installation to bypass Android 13+ restrictions, while ClayRat spreads through 25 phishing domains impersonating YouTube and Russian taxi apps. Organizations should monitor for accessibility service abuse patterns and enforce sideloading restrictions to mitigate these threats.