Executive Summary
A sophisticated Android malware campaign has been identified using a multi-stage infection chain to deploy a new Remote Access Trojan (RAT) dubbed OrbitalVoyage. The initial attack vector involves a malicious APK (TkTok_Candy.apk) that masquerades as the TikTok app. The dropper employs a novel 'VPN black-hole' technique, persuading victims to enable a VPN that silently drops all network traffic. This prevents Google Play Protect from reaching its cloud backend to perform real-time security verdicts while the final payload is installed via Android's PackageInstaller session.
Once active, OrbitalVoyage RAT leverages Android's Accessibility Services to gain full control over the device. It features advanced capabilities including remote UI manipulation, overlay phishing, notification interception, and screen capture. The malware specifically targets Android 14 and later, using techniques similar to those observed in Octo2 malware to bypass 'Restricted Settings' protections.
While the specific targets remain unconfirmed, lures are localized in 30 languages, primarily targeting regions in Africa, the Middle East, Southeast Asia, and Latin America. The presence of Russian code comments suggests a Russian-speaking developer, though attribution is not definitive. The high level of remote control and data theft capabilities poses a significant risk to mobile banking and personal communications.