cifrat Android RAT impersonates Booking.com

CERT Polska documented cifrat, a multi-stage Android RAT delivered via fake Booking.com update pages, granting attackers accessibility-based remote control, SMS, camera and SOCKS5 access.

CERT Polska analyzed an Android malware sample, internally named cifrat after its package string and RAT capabilities, distributed through a phishing chain that impersonates Booking.com's Pulse partner application. Victims receive a phishing email leading through a share.google redirect to a fake booking.interaction.lat update page, which serves a malicious APK (com.pulsebookmanager.helper). This outer dropper loads a native library for anti-debugging/anti-analysis checks and string deobfuscation, then XOR-decrypts and installs a second APK (io.cifnzm.utility67pu, disguised as 'Google Play Services') via PackageInstaller. That second stage already ships accessibility, SMS, device-admin, screen-capture, and camera components, but its Application class further decrypts a hidden asset (FH.svg) using an RC4-like cipher to unpack the final malicious dex files.

The fully unpacked payload is a persistent Android RAT featuring accessibility-driven overlay injection, keylogging, screen and camera streaming, SMS collection, remote gesture injection, uninstall protection, and SOCKS5 tunneling, all controlled through a dual WebSocket architecture (separate control and data channels) connected to otptrade.world. Installation telemetry (dropper_opened, install_started, implant_launched, etc.) is reported to a separate infrastructure host, aplication.digital. Throughout the infection chain, the malware repeatedly re-displays the same spoofed Booking.com branded page to maintain the illusion of a legitimate security update, while building increasingly deep layers of obfuscation, native code gating, and persistence mechanisms typical of commercial Android RAT-as-a-service tooling.

CERT Polska could not confidently attribute the sample to a known malware family or threat actor at analysis time. The report provides technical unpacking methodology (XOR/RC4 key recovery, native JNI string decoding) enabling defenders and researchers to reproduce each unpacking stage independently.

Source reporting: https://cert.pl/en/posts/2026/04/cifrat-analysis