Astrinox
Astrinox is an Android banking trojan family identified by Zimperium zLabs as part of a cluster of campaigns alongside RecruitRat, SaferRat, and Massiv. It has been tracked internally by Zimperium for several months and overlaps with research from Cleafy Labs, which identified the same threat as Mirax. The campaigns collectively target more than 800 applications across banking, cryptocurrency, and social platforms, with the objective of stealing sensitive data and enabling fraud.
Astrinox is distributed through phishing and social-engineering lures that trick users into sideloading malicious APKs. Reported lures include fake business-tool applications and a fake Apple App Store page that served Android-targeting content; Zimperium also reported Astrinox using the domain xhire[.]cc and serving different phishing content depending on the client user-agent. Like the related campaigns, it relies on attacker-controlled websites, smishing, and cloned or fake apps to gain installation.
Once installed, Astrinox abuses Android Accessibility Service and overlay capabilities. It presents fake login screens over legitimate banking and cryptocurrency apps, monitors user activity, and triggers cloned overlays when targeted apps are opened. It can steal credentials, authentication codes, device PINs, patterns, or passwords through fake lock-screen and app-login overlays. Astrinox and Massiv were specifically observed using static or persistent full-screen overlays disguised as Android system prompts or updates to block user interaction while authorizing actions, triggering navigation clicks behind the overlay, or facilitating malicious transaction approval.
Zimperium reported that these malware families request Accessibility permissions, use non-interactive overlays to hide dangerous permission grants, and can obtain access to contacts, device state, and SMS messages. Across the reported campaigns, capabilities include screen-content monitoring, interaction abuse via clicks/swipes/typing, interception of SMS-delivered OTPs, keylogging of user taps, and screen recording or live screen streaming via MediaProjection. Astrinox was also reported to use WebSocket-based bidirectional command-and-control communications.
From an evasion and payload-delivery perspective, Astrinox encrypts its core payload, reconstructs it from Base64 segments, decrypts it in memory with AES/GCM, and writes the resulting APK to cache for execution. The repository context also indicates APK-related artifacts and IOC tracking for Astrinox, with an April 15, 2026 update adding indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Stealth
1 technique
Stealth
Credential Access
3 techniques
Credential Access
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android banking malware in a campaign targeting banking, crypto, and social apps. It abuses overlays and permissions to capture credentials and PINs; Astrinox was observed deploying static full-screen overlays disguised as system prompts or updates to authorize actions and trigger navigation clicks.
Android malware family masquerading as business tools and hosted on a fake Apple App Store page. It performs overlay attacks against banking and crypto apps, abuses Accessibility Service permissions, steals credentials, contacts and SMS messages, intercepts OTPs, records screens, and keylogs taps.
Android banking trojan family masquerading as HireX and using user-agent-aware phishing infrastructure. It encrypts its core payload, reconstructs it from Base64 segments, decrypts it in memory with AES/GCM, writes the APK to cache for execution, uses WebSocket C2, performs app inventory exfiltration, and deploys deceptive update overlays and credential-harvesting screens.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.