PromptSpy IpcSocket Localhost TCP Listener for IPC

Subhankar H@Andrewsec57

•updated Jul 8, 2026•0•0•2

Detects the initialization of the PromptSpy malware's custom 'IpcSocket' class, which establishes a TCP listener bound to the localhost (127.0.0.1) address. This mechanism is utilized for inter-process communication between various components of the PromptSpy malware to coordinate malicious activities on the Android platform.