Octagon Android Malware Abuses Accessibility Features for Banking and Crypto Account Takeovers
A new Android malware-as-a-service, Octagon, is targeting banking and cryptocurrency accounts by exploiting accessibility features to steal credentials and one-time SMS codes.
Octagon, a sophisticated Android malware-as-a-service, has emerged as a potent threat to banking and cryptocurrency users, enabling account takeovers through the abuse of device accessibility features. Sold on underground cybercrime forums for a monthly fee of $1,400, Octagon provides criminals with a ready-made platform to steal login credentials, capture sensitive SMS one-time passcodes, and exert remote control over infected devices. This "malware-as-a-service" model lowers the barrier to entry for financially motivated cybercriminals, democratizing access to advanced account takeover tools.
Researchers at iVerify first identified Octagon in June 2026, linking it to a seller known as "AndroidKitKat" on Russian-language cybercrime forums. The malware's primary mechanism involves tricking users into sideloading malicious applications, often disguised as legitimate software through deceptive app stores, unrelated themes, or fake public service messages. Once installed, Octagon leverages Android's accessibility services, which, when granted by unsuspecting users, allow the malware to read screen content, inspect application interfaces, overlay fake login forms onto legitimate apps, and simulate user interactions.
The impact of Octagon is particularly severe for users of banking applications, cryptocurrency wallets, and exchanges. The malware's ability to capture SMS messages is critical, as many financial institutions use two-factor authentication via SMS codes for login verification. By intercepting these codes, Octagon operators can bypass multi-factor authentication even after stealing a user's password, thereby completing the account takeover process. The malware can also capture screenshots, record unlock patterns, PINs, and passwords, and simulate taps or text input, providing attackers with comprehensive control.
Octagon's capabilities are further demonstrated by its support for specific financial applications, with templates found for Trust Wallet, Binance, and MEXC, among others. This targeted approach indicates a clear intent to facilitate direct financial theft. The malware communicates with a Windows-based control panel, allowing buyers to monitor compromised devices, push tailored overlay screens, and steer the victim's device in real time. This on-device fraud model can circumvent traditional security measures that might flag suspicious remote logins.
Analysis of recovered APK samples revealed a consistent client design, encrypted command-and-control (C2) connections, and the use of overlay assets. Some samples presented as harmless launchers, while others, like the "Lifted Dreams" variant, concealed their malicious nature behind seemingly innocuous visual novel interfaces until permissions were requested. This social engineering aspect is crucial to Octagon's distribution, with some campaigns employing fake government or Google Play pages to lure victims into downloading the malware.
While Google Play Protect may not always flag these malicious applications, especially when they are sideloaded, user vigilance remains paramount. The malware's ability to operate with broad visibility and control after gaining user-granted accessibility access highlights the risks associated with granting excessive permissions. Security experts strongly advise users to install banking and wallet applications only from official sources, to be extremely wary of unsolicited links and prompts to install files, and to treat any unexpected requests for sensitive permissions as a significant warning sign.
For cryptocurrency users, the importance of protecting recovery phrases cannot be overstated. These phrases are the master keys to digital assets and should never be entered into pop-up overlays, unofficial installers, or suspicious support pages, as demonstrated by previous incidents like the SparkKitty wallet theft. Defenders are advised to hunt for sideloaded apps exhibiting specific behaviors, such as combined accessibility and app discovery features, foreground execution, and battery exclusions, and to monitor for encrypted TCP traffic on port 4444.
Octagon represents a significant advancement in the Android malware landscape, offering a powerful and accessible toolkit for cybercriminals aiming to compromise financial accounts. Its reliance on social engineering and the abuse of legitimate Android features underscores the evolving tactics used to bypass security measures and exploit user trust for financial gain.