Wedding Invitations - Tria stealer campaign

FanJ · Feb 3, 2025

Kaspersky - 30 Jan 2025
No need to RSVP: a closer look at the Tria stealer campaign
https://securelist.com/tria-stealer-collects-sms-data-from-android-devices/115295/

Since mid-2024, we’ve observed a malicious Android campaign leveraging wedding invitations as a lure to social-engineer victims into installing a malicious Android app (APK), which we have named “Tria Stealer” after unique strings found in campaign samples. The primary targets of the campaign are users in Malaysia and Brunei, with Malaysia being the most affected country.
Click to expand...

Our findings, in a nutshell, are as follows:
- Tria Stealer collects victims’ SMS data, tracks call logs, messages (for example, from WhatsApp and WhatsApp Business), and email data (for example, Gmail and Outlook mailboxes).
- Tria Stealer exfiltrates the data by sending it to various Telegram bots using the Telegram API for communication.
- The threat actor then exploits this data to hijack personal messaging accounts, impersonate account owners to request money transfers from the victims’ contacts, and compromise accounts with other services.
Click to expand...

Log in or Sign up

Wedding Invitations - Tria stealer campaign

FanJ Updates Team

Log in or Sign up

Wedding Invitations - Tria stealer campaign

FanJ Updates Team

Useful Searches