Black Hawk Android RAT (STAR Labs, 17 Oct): one dropper-plus-RAT reskinned as fake e-Tax, Rakuten, SMBC, Mercari and LINE apps, run from two hawk-branded Chinese-language panels; steals unlock PINs and payment input and self-pairs with ADB to escalate
STAR Labs (Singapore) published a teardown on 17 October 2026 of an Android remote-access trojan family it calls Black Hawk, after its operator panel, which brands itself 黑鹰安卓远控 ('Black Hawk Android Remote Control') or, on a second host, 雄鹰安卓远程 ('Eagle Android Remote'). The researchers analysed 64 samples first seen between 15 September and 16 October 2026. Each is a small dropper that asks for permission to install other apps and then installs a packed second-stage WebSocket RAT. The same RAT is dressed up as many different apps: Japan's e-Tax service, Rakuten and Mitsui Sumitomo (SMBC) card points, Saison, Mercari, LINE points, a fake SpaceX '6G' investment app, dating apps and live-TV players. App names carry invisible zero-width characters between letters so simple name-based detection rules miss them, and each fake app opens the real brand's website as cover. Droppers are packed either with a simple native XOR stub (libsa.so, whose key sits in plain text) or with the open-source nmmp VM protector, which STAR Labs says can be undone because its VM is a reshuffled copy of Android's own interpreter. All samples are signed with the public Android debug certificate, so grouping by certificate is useless. Once installed, the RAT talks to its panel over an authenticated, certificate-pinned WebSocket; streams and remotely drives the screen through Accessibility gestures; captures the lock-screen password, PIN and pattern and keystrokes; scrapes typed values from Alipay and WeChat; injects JavaScript into WebViews; and can launch or block apps. It also pairs with the phone's own wireless ADB service to grant itself WRITE_SECURE_SETTINGS, and persists through device-admin, boot, push-message, job and alarm hooks running in a separate process. STAR Labs judges the operation financially motivated and commodity-grade. Two panels (www.mm2mm[.]xyz and www.hyzj[.]shop) were live on 16 October; C2 and distribution hosts sit mostly on Alibaba Cloud and rotate often. Published indicators include C2 domains www.mengm[.]shop, cihqobpe.receivewelfarebenefits[.]com, www.collectpointsjp[.]com, www.knjw[.]shop and tnt.freedomdf[.]xyz, and the romance front datingparadise[.]vip. No CVE or vendor patch is involved, and the lures target Japanese users; no Australian victims are reported. Primary: STAR Labs.
- Product
- Android devices (sideloaded fake brand apps: Black Hawk / Eagle dropper and WebSocket RAT)
- Versions
- n/a — malware campaign; 64 samples first seen 15 Sep to 16 Oct 2026
- Exploited in Australia?
- unknown
- Patch to
- Users: install apps only from Google Play, keep Play Protect on, and refuse apps that ask to install other apps or to turn on Accessibility, device-admin or wireless debugging. MDM/mobile security teams: block sideloading and the 'install unknown apps' permission, alert on non-developer apps holding WRITE_SECURE_SETTINGS or doing local ADB pairing, and hunt for the dropper traits STAR Labs lists (components Wv, Bv and Ir, a <package>.INSTALL_COMPLETE receiver, PlatformAssistDaemon service, libsa.so or libnmmp.so, zero-width characters in app labels). Block the published C2 and phishing domains at DNS and proxy.
Primary: STAR Labs — Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands (17 Oct 2026) · Vendor: STAR Labs research (primary)