A remote access trojan for Android called Octagon is impersonating the official emergency alerts application from Bahrain to seize control of devices and exfiltrate sensitive information.
The attack starts when users download the file BH-Alert.apk from phishing pages. The application mimics legitimate services and walks victims through seven separate steps to obtain dangerous permissions. The first component stores part of its code in encrypted form inside a file that uses a font extension. This content is decrypted and loaded only during runtime, making static analysis significantly more difficult.
After initial execution, the malware installs a second application named OctagonPanel. Dedicated surveillance services continuously monitor one another and automatically restart any components that are killed. Boot receivers ensure the threat reactivates after the device is powered on.
Octagon further creates a fake account on the Android system and schedules synchronization tasks every 30 minutes. This mechanism wakes the malware, fetches updated configuration data, and re-establishes communication with the command-and-control server.
By abusing the Accessibility Service, the threat records PINs, passwords, and unlock patterns. The 200 most recent entries can remain stored on the device before being transmitted. The RAT also collects SMS messages, contacts, call logs, and screenshots while displaying fake overlay pages for other applications. A VPN controlled by the attackers can intercept or redirect the victim’s network traffic.
