Hirudo, an Android trojan, swaps eight Indonesian banking apps for patched copies that blind their own integrity checks, ThreatFabric says. The victim must approve the swap, and afterwards the app's checks answer as the operator scripts them.
Perspective Coverage
5 publishers
- Builder
- Builder 27%
- Operator
- Operator 51%
- Investor
- Investor 22%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence70
Group-IB says the RemControl Android banking trojan reaches bank customers in six countries and the Middle East via Meta ads and fake Google Play pages. Its server address sits in a Telegram dead-drop, so the operator can move infrastructure without a new build.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence65
ThreatFabric says the Android spyware encrypts stolen data and relays it over Wi-Fi Direct and Bluetooth when it cannot reach its C2, using up to four hops by default.
Perspective Coverage
4 publishers
- Builder
- Builder 36%
- Operator
- Operator 58%
- Investor
- Investor 6%
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence68
ThreatFabric traced the StreamRat dropper through four ordinary Android permission prompts to an Accessibility grant that hands operators keystrokes, credential overlays and remote control, with no infection count published.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence60
Zimperium's September 9 write-up describes an Indonesian-linked family that encrypts files and streams the screen at once, resolves its command server through a GitHub repository, and loses most of its encryption reach on Android 10.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives30
- Confidence65
Google explained Pulse to a press outlet before it explained it to Android users
The service has been on devices since March, but the app entry that made it visible is only days old, and it cleared 10 million downloads before anyone in support had a sentence to hand out.
Reality
- Evidence40
- Adoption66
- Hype gap+18
- Incentives55
- Confidence45
Android's "unverified developer" flow ships, and the burden shifts to whoever builds the APK
Google says the first version of its Advanced Flow is rolling out for installs from unverified developers. The reported announcement carries no criteria, no dates and no scope.
Reality
- Evidence34
- Adoption22
- Hype gap+12
- Incentives68
- Confidence31
buildOne report1 publisher Sideloading becomes a registered activity: budgeting for Android's September 2026 deadline
Google's Developer Verification pulls APK drops, F-Droid builds and internal company tools into one registry, with Brazil, Indonesia, Singapore and Thailand first, according to a dev.to account.
Reality
- Evidence28
- Adoption
- Not scored
- Hype gap+42
- Incentives62
- Confidence31