Novinarya: An Android stealer that hides its live C2 in a shop bio

This is a well-documented Android stealer with a clever C2 obfuscation technique. The dead-drop still being live is a rare find.

Technical Breakdown

• Initial Access & Obfuscation: The dropper (ir.novinarya) contains a 18 KB loader (net.swiftnova.bridge). On execution, a 29 KB native library (libuibridge_9203.so) unpacks the real payload from assets/app_cache.db using RC4 (32-byte key, 768-byte drop) + zlib. Key and asset names are randomized per build.
• C2 Discovery (The Novel Part): The C2 is not hardcoded. The manifest contains an encrypted pointer that resolves to a seller's bio on a legitimate marketplace. The live dead-drop revealed the real C2: theapi.the-x-services[.]xyz.
• Targeting: Enumerates installed apps via QUERY_ALL_PACKAGES, targeting 54 crypto exchanges/wallets and 27 Iranian banking apps.
• Credential Theft: Uses a phishing WebView (not overlay attacks). The operator controls the page via WebViewURL, and a JavaScript form-grabber exfiltrates data through a native B4A bridge. No accessibility or overlay permissions requested.
• SMS & Notification Interception: Captures one-time passcodes from SMS and notifications.
• IOCs:
  • Sample SHA-256: be165239e4fe899b1f2eedf6459d363bca4fe6856fda87a63ba5d4e5e612e1c9
  • Package: ir.novinarya
  • Loader Package: net.swiftnova.bridge
  • Live C2: theapi.the-x-services[.]xyz

Defense

Monitor for outbound connections to theapi.the-x-services[.]xyz and block installation of apps from untrusted sources, particularly those requesting QUERY_ALL_PACKAGES without a clear business need. The use of a legitimate marketplace for C2 dead-drops makes DNS-based blocking of the initial resolution point difficult.

Source: https://starlabs.sg/blog/2026/10-novinarya-an-android-stealer-that-hides-its-live-c2-in-a-shop-bio/