cifrat Android RAT impersonates Booking.com
CERT Polska documented cifrat, a multi-stage Android RAT delivered via fake Booking.com update pages, granting attackers accessibility-based remote control, SMS, camera and SOCKS5 access.
Sourcecert.pl — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
CERT Polska analyzed an Android malware sample, internally named cifrat after its package string and RAT capabilities, distributed through a phishing chain that impersonates Booking.com's Pulse partner application. Victims receive a phishing email leading through a share.google redirect to a fake booking.interaction.lat update page, which serves a malicious APK (com.pulsebookmanager.helper). This outer dropper loads a native library for anti-debugging/anti-analysis checks and string deobfuscation, then XOR-decrypts and installs a second APK (io.cifnzm.utility67pu, disguised as 'Google Play Services') via PackageInstaller. That second stage already ships accessibility, SMS, device-admin, screen-capture, and camera components, but its Application class further decrypts a hidden asset (FH.svg) using an RC4-like cipher to unpack the final malicious dex files.
The fully unpacked payload is a persistent Android RAT featuring accessibility-driven overlay injection, keylogging, screen and camera streaming, SMS collection, remote gesture injection, uninstall protection, and SOCKS5 tunneling, all controlled through a dual WebSocket architecture (separate control and data channels) connected to otptrade.world. Installation telemetry (dropper_opened, install_started, implant_launched, etc.) is reported to a separate infrastructure host, aplication.digital. Throughout the infection chain, the malware repeatedly re-displays the same spoofed Booking.com branded page to maintain the illusion of a legitimate security update, while building increasingly deep layers of obfuscation, native code gating, and persistence mechanisms typical of commercial Android RAT-as-a-service tooling.
CERT Polska could not confidently attribute the sample to a known malware family or threat actor at analysis time. The report provides technical unpacking methodology (XOR/RC4 key recovery, native JNI string decoding) enabling defenders and researchers to reproduce each unpacking stage independently.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/04/cifrat-analysis
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs