Technical threat intelligence, malware research, and security insights directly from Cleafy's analysts.
Joined April 2021
- Tweets 135
- Following 0
- Followers 432
- Likes 4
95 Photos and videos
May 19
[1/4]๐จ DevilNFC & NFCMultiPay: two new Android NFC relay malware families actively hitting European and LATAM banking customers. Developed independently by Spanish-speaking and Portuguese (Brazilian) TAs. The Chinese monopoly on NFC relay tooling is over.
1
7
26
3,059
May 19
[3/4] DevilNFC's standout: a single Dual-Role APK with a passive reader on the victim's device and a full system-level card emulator on the attacker's rooted hardware via Xposed Framework hooking into the Android NFC daemon.
1
1
209
May 19
[4/4] Our full technical analysis is available here ๐
cleafy.com/cleafy-labs/nfc-rโฆ
2
119
Apr 15
[1/4]๐จ APK Malformation is no longer a niche evasion tactic; it is now a standard in the Android MaaS ecosystem. Observed in 3,000 samples across families like TeaBot, TrickMo, and SpyNote, it keeps malware fully functional while blinding static analysis tools.
1
13
20
1,876
Apr 15
[3/4] To counter this, we're open-sourcing Malfixer, presented today at @Botconf 2026. Built over 2 years, it detects and surgically repairs all three malformation categories, rebuilding clean APKs ready for standard pipelines, without altering the payload.
1
5
8
587
Apr 15
[4/4] Our full technical analysis is available here ๐ cleafy.com/cleafy-labs/malfoโฆ
Malfixer open-source on GitHub ๐ github.com/Cleafy/Malfixer
4
2
306
Apr 10
[1/4] ๐จ We tracked Mirax, a new Android RAT and banking malware operating as a private MaaS. First promoted on underground forums in December 2025, it's been actively targeting Spanish-speaking countries through Meta ad campaigns, reaching over 200,000 accounts.
1
4
7
292
Apr 10
[3/4] Beyond standard Android RAT capabilities, Mirax introduces an interesting feature: SOCKS5 proxy via Yamux multiplexing. Infected devices become proxy nodes, enabling attackers to mask malicious traffic behind legitimate IPs, even when full RAT infection fails.
1
3
172
Apr 10
[4/4] Our full technical analysis is available here ๐
cleafy.com/cleafy-labs/miraxโฆ
2
117
Mar 5
๐จ (1/7) Guess who's back? We identified a new dropper associated with the TeaBot banking trojan within the Google Play Store, with over 100K downloads. The malicious app masquerades as a PDF reader/file manager and has been active from 12th to 19th February 2026.
1
5
13
464
Mar 5
(6/7) Following our analysis, the Cleafy Labs team responsibly disclosed all findings to Google. The application was removed from the Play Store on February 19, 2026. We thank Google for the prompt action taken following our report.
1
179
Mar 5
(7/7) IOCs:
๐น Dropper MD5: 612e1e4cef13c5c1f5f155d5b1a73016 ๐น Payload MD5 (TeaBot): 574742ad9a1eb519fce8b7c2b8795677
๐น Play Store: hxxps://play.google[.]com/store/apps/details?id=com.backforge.olimpic.axiomdrivecenter
1
138
28 Nov 2025
[1/4] ๐จ We tracked Albiriox, a newly identified Android malware family offered as a Malware-as-a-Service (MaaS). Hardcoded targets indicate a broad target spectrum, encompassing major banking and cryptocurrency applications worldwide.
1
3
9
3,267
28 Nov 2025
[3/4] Albiriox exhibits the core features of modern Android Banking Trojans, enabling TAs to perform On-Device Fraud (ODF) through remote control, screen manipulation, and real-time interaction with the infected device.
1
1
240
28 Nov 2025
[4/4] Our technical analysis is available here ๐
cleafy.com/cleafy-labs/albirโฆ
1
210