Our latest investigation reveals a sophisticated Android malware campaign, codenamed Ajina, targeting Central Asia. Named after a mythical spirit from Uzbek folklore, this malware deceives users by posing as legitimate apps, compromising personal and financial data across the region. Our investigation revealed over 1,400 unique samples, highlighting the attackers' regional knowledge and growing reach.

Discover how these malicious actors are spreading malware through Telegram, the techniques they're using, and the broader implications for users and businesses alike.

🛡️ Stay informed and stay secure.

Read the full analysis by our experts now

#CyberSecurity #ThreatIntelligence #infosec #FightAgainstCybercrime #AndroidMalware #Telegram

🚨 Qwizzserial: The New Face of Android SMS Stealers primarily in Uzbekistan!
A previously unknown malware family is making waves across Uzbekistan, blending social engineering with technical stealth to bypass defenses and hijack finances.

Key Highlights:
🔹 Over 100,000 Android infections in just 3 months
🔹 Telegram bots used to auto-generate malware disguised as government aid apps
🔹 $62,000+ stolen by a single group using fake “financial support” schemes
🔹 Advanced evasion techniques: USSD SIM hijacking, infinite preloaders, obfuscation with NP Manager and Allatori

This is not just another stealer — it’s the evolution of the Classiscam model.

Read the full breakdown, infrastructure, attribution, and mitigation tips in our technical blog.

#AndroidMalware #ThreatIntel #Classiscam #Qwizzserial #SMSStealer #FightAgainstCybercrime

🚨Android-based financial fraud in Uzbekistan has entered a new stage of operational maturity, with threat actors shifting from simple SMS stealers to sophisticated, multi-stage infection chains built around stealthy droppers, advanced obfuscation, and automated infrastructure.

Key Highlights:
🔹Over $2M stolen by a single tracked group since January 2025
🔹Two primary dropper families, MidnightDat and RoundRift, were identified using native decryption and encrypted asset storage.
🔹Wonderland, a new SMS stealer with bidirectional WebSocket C₂, enables real-time command execution, SMS sending, and USSD control.
🔹Telegram remains the central distribution channel, fueled by stolen sessions sold on dark web markets.
🔹Thousands of unique samples generated through automated build pipelines to evade signature-based detection

🔗 Read the full analysis here.

#ThreatIntelligence #AndroidMalware