Analysis of FvncBot campaign

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://cert.pl/en/posts/2026/03/fvncbot-analysis/
• Blog Title: Analysis of FvncBot campaign
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new subsection: "Android Accessibility Services Abuse (RAT/UI automation)" and/or "Dynamic Code Loading (DexClassLoader) / staged loaders")

🎯 Content Summary

Title / context
CERT Polska analyzed new Android samples tied to the FvncBot campaign targeting Polish users (write-up date: 30 March 2026, SGB-branded variant). The chain is primarily social engineering + multi-stage loaders + abuse of Android Accessibility (not a CVE-based exploit). The end result is a VNC-like/remote-access Trojan with credential theft and transaction fraud capability via UI automation.

1) Victim-facing infection flow (what the user...

🔧 Technical Details

Two-app social engineering chain (lure → hidden implant)
A visible “bank token/security” lure app drives the victim through (1) granting Install unknown apps, (2) installing a hidden second-stage APK branded as a system component, then (3) enabling an Accessibility Service masquerading as an OS update. This yields privileged UI automation without exploiting a CVE, because the attacker obtains the capability through user-granted Accessibility permissions.

On-device multi-stage loader using DexClassLoader from private storage
Decode staged bytes (here: XOR with a short key) into an app-private file (e.g., /data/user/0/<pkg>/app_tell/tWyWeG.txt) and load it at runtime with DexClassLoader. This moves malicious logic outside the main dex and evades purely static detections; optimized output is placed into the specified private directory as part of the classloading process.

Embedded APK dropping + deep-li...

🤖 Agent Actions

I’m mapping the repo first and then I’ll read the Android/mobile files that are closest to Accessibility abuse, overlays, and staged loaders so the update lands in the right place.
The repo already has Android-specific pages for both Accessibility abuse and deobfuscation/loading. I’m narrowing down whether this write-up adds net-new operator workflow details or whether those tricks are already covered elsewhere and only need a concise augmentation.
I’ve read enough to see the repo already covers generic Accessibility RATs and dropper patterns. The remaining question is whether FvncBot contributes a tighter, reusable technique section inside the Accessibility page or whether the deobfuscation page is the cleaner fit for the staged loader details.
I’ve picked the target file: the Accessibility abuse page is the right place because the write-up’s value is the operator workflow around Accessibility-driven RAT control, with the staged loaders as supporting tradecraft. I’m adding a short FvncBot-derived subsection and a detection note, then I’ll verify the diff and references.
The patch missed the exact surrounding text in the target file. I’m re-reading the relevant spans and then I’ll apply the change against the file’s actual structure instead of assuming the nearby wording.
The edit is in place. I’m checking the inserted sections in context and reviewing the diff to make sure the markdown is clean, the scope stayed in one file, and the references section is still at the end.
Updated accessibility-services-abuse.md.

I kept the change in a single file and added only the parts that were missing from existing coverage: the two-app sideload-to-Accessibility chain, app-private DexClassLoader staging with non-obvious file extensions, deep-link/provider-gated handoff, hidden asset-to-final-dex unpacking, and FvncBot’s text-mode VNC pattern around UI-tree capture plus rich TYPE_VIEW_TEXT_CHANGED interception. I also added the CERT Polska article to the file’s ## References section.

Verified with git diff; no other files were changed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://cert.pl/en/posts/2026/03/fvncbot-analysis/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new subsection: "Android Accessibility Services Abuse (RAT/UI automation)" and/or "Dynamic Code Loading (DexClassLoader) / staged loaders")".

Repository Maintenance:

• MD Files Formatting: 964 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0