Octagon: New Android Malware Drains Crypto Wallets and Banking Apps via Fake Overlays
Kiran 
A previously undocumented Android fraud tool called Octagon is now circulating on Russian-language cybercrime forums as a subscription service, enabling low-skilled criminals to hijack phones, read on-screen balances, and drain crypto wallets without ever triggering an antivirus alert.
Researchers at iVerify’s threat intelligence team first spotted the malware-as-a-service (MaaS) offering in June 2026, when a seller using the handle AndroidKitKat began advertising it on a Russian-speaking forum.
The listing, posted June 1 under member ID 221700, promised buyers a full on-device fraud kit: accessibility-based overlays, a hidden VNC remote control, SMS and one-time password interception, unlock pattern capture, and live balance reading from targeted apps. A version 1.2 update followed on June 29, suggesting active development and a growing customer base.
Octagon: New Android Malware
Octagon isn’t a single virus; it’s a platform. Buyers pay roughly $1,400 a month for access to a Windows-based command-and-control panel that treats every infected phone as a “Ward,” a term borrowed from the malware’s internal architecture.
Operators can inspect installed apps, view the device screen in real time, launch fake login overlays, and remotely control the handset. Panel screenshots reviewed by researchers show templates already built for Trust Wallet, Binance, and MEXC, with the option for buyers to add custom overlay targets.
The Android component, packaged as com.kisa.octagonpanel, hinges on a service called WardAccessibilityService. Once a victim grants accessibility permissions, often after sideloading an app disguised as something unrelated, like a game or government utility, Octagon reads the app’s interface tree and overlays a fake HTML login screen to steal seed phrases, passwords, and PINs.
What makes Octagon particularly dangerous is its ability to evade. In one documented case, Google Play Protect scanned an infected device and reported “No harmful apps found,” even as the malware actively read the screen through legitimate Android accessibility APIs.
Because Octagon abuses features the user was tricked into enabling rather than exploiting a software flaw, standard malware signatures largely miss it.
iVerify recovered three related APK samples internally named Octagon, Lifted Dreams, and BahrDate — all built from the same client but wrapped in different disguises.
Lifted Dreams hides behind a visual-novel game and actively requests SMS permissions to intercept one-time passcodes, while BahrDate skips that request entirely. All three connect over an encrypted TCP channel on port 4444 and share a hardcoded default passphrase, octagon-default-key-change-me, left over from development.
The connection extends beyond Octagon’s own builds. Dream Group separately traced a nearly identical OctagonPanel/Ward payload to the “BH Alert” campaign in Bahrain, which impersonated the Bahrain Civil Defense agency and fake Google Play pages to trick users into sideloading malware.
That payload shared the same package name, protocol, default passphrase, and control port as the Octagon samples, strong evidence that the same developer’s code is being reused, or resold, across distinct criminal operations.
Security teams are advised to hunt for a consistent set of indicators regardless of which cover story a given build uses: the package name com.kisa.octagonpanel, strings like WardAccessibilityService, OctagonBridge, and GUARDIAN_SET_PACKAGE_TEMPLATES, and outbound encrypted connections on TCP port 4444.
Because Octagon’s infrastructure and lure content change between campaigns, these code-level fingerprints are likely to remain the most durable detection method as AndroidKitKat continues selling access to new buyers.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
