Cybercriminals have developed sophisticated malware campaigns targeting Android users by exploiting .NET MAUI, a cross-platform development framework, to evade traditional security measures.
These threats disguise themselves as legitimate banking and social networking applications to harvest sensitive information from unsuspecting users.
The malware’s ability to hide its malicious code within blob binary files rather than conventional DEX files enables it to bypass many antivirus solutions that focus primarily on analyzing standard components.
.NET MAUI, introduced by Microsoft as a replacement for Xamarin after support ended in May 2024, extends platform support beyond mobile to include Windows and macOS.
It runs on .NET 6+ and offers performance optimizations through a lightweight handler-based architecture.
This evolution in cross-platform development has unfortunately provided cybercriminals with new avenues to exploit technological advancements.
McAfee researchers noted multiple variants of this malware campaign, noting that the threats primarily spread through unofficial app stores where users are directed via phishing links in messaging groups or text messages.
The research team discovered that these malicious applications target specific demographics, including Indian users with fake banking apps and Chinese-speaking users with social media imitations.
Distribution occurs primarily through unauthorized websites or alternative app stores, particularly targeting regions with limited access to official app stores.
This distribution strategy allows attackers to spread malware more efficiently among vulnerable populations who may have fewer options for obtaining applications.
.webp)
The campaigns specifically include a fake IndusInd Bank app targeting Indian users and various fake social media apps resembling X (formerly Twitter) targeting Chinese-speaking users.
When victims install these apps, they’re prompted to enter personal information including banking credentials, contact details, and other sensitive data, which is then transmitted to attacker-controlled command and control servers.
Detection Evasion Techniques
The malware’s sophisticated evasion methodology centers around concealing code in non-traditional locations.
Unlike conventional Android malware where malicious code resides in Java or native libraries, these threats hide their functionality within blob files located in the assemblies directory.
.webp)
While the C# code responsible for data theft remains invisible to traditional scanning mechanisms that focus on DEX files.
// Example of the C# code responsible for stealing user data and sending it to C2
// Hidden within blob files in the assemblies directoryThe fake social media variant employs an even more sophisticated approach with multi-stage dynamic loading.
It decrypts and loads malicious components in three separate stages: first decrypting an XOR-encrypted loader, which then decrypts an AES-encrypted second stage, finally revealing the core .NET MAUI framework with the malicious payload.
This layered approach significantly complicates analysis and detection efforts.
Additional obfuscation techniques include manipulating the AndroidManifest.xml file with excessive random permissions that disrupt automated analysis tools and using encrypted socket communications instead of standard HTTP requests to evade network traffic monitoring.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
