VORANT. Threat Intelligence Sign in Get the full feed

Cifrat Android RAT targets Booking.com users

high threat technology

CERT Polska analyzed a multi-stage Android RAT dubbed Cifrat, distributed via phishing emails impersonating Booking.com, that deploys accessibility-based remote control over WebSockets.

CERT Polska has disclosed analysis of an Android remote access trojan they call Cifrat, distributed through infrastructure impersonating Booking.com. The infection chain begins with a phishing email directing victims through a Google share link to a fake Booking.com security update page at booking.interaction.lat, which delivers a malicious APK (com.pulsebookmanager.helper.apk). The dropper employs a multi-stage unpacking process: it loads a native library that decrypts a second APK (io.cifnzm.utility67pu, labeled Google Play Services), which in turn extracts and decrypts a hidden asset (FH.svg) using an RC4-like cipher, revealing the final RAT payload.

The final stage establishes dual WebSocket channels to otptrade.world for command-and-control, separating control messages from data exfiltration. The malware abuses Android accessibility services to enable extensive remote control capabilities including screen streaming, keylogging, HTML overlay injection, SMS collection, camera access, remote gestures, device manipulation, and SOCKS5 proxy tunneling. The sample includes anti-analysis checks for debuggers and emulators, uses XOR and custom RC4 decryption with JNI-backed string obfuscation, and implements uninstall protection and service health monitoring for persistence.

CERT Polska could not confidently map Cifrat to a known malware family at the time of analysis. The campaign specifically targets users of Booking.com's Pulse application, leveraging convincing brand impersonation to deliver a sophisticated, multi-layered Android RAT with full remote-access capabilities.

Mentioned in this report

Malware cifrat

Detection guidance

Accessibility Service Enabled via Settings Command on Android

ATT&CK T1628.001

Detects use of the 'settings put secure enabled_accessibility_services' command to grant an app accessibility privileges, a technique used by Android RATs like Cifrat to gain screen reading, input capture, and remote control capability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Accessibility Service Enabled via Settings Command on Android
id: aabf28cd-dcda-58ca-83da-b1a67e72995b
status: experimental
description: 'Detects execution of the Android ''settings'' shell command to enable
  an accessibility service for a package, a common technique used by Android RATs
  (e.g. Cifrat) to abuse accessibility services for screen streaming, keylogging,
  overlay injection, and remote gestures.

  '
logsource:
  category: process_creation
  product: android
detection:
  selection:
    Image|endswith: /settings
    CommandLine|contains|all:
    - put
    - secure
    - enabled_accessibility_services
  filter_known_admin:
    CommandLine|contains:
    - com.google.android.marvin.talkback
    - com.android.talkback
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate accessibility tools (TalkBack, Switch Access) being enabled by users
  with disabilities
- Enterprise MDM solutions configuring accessibility settings for compliance apps
level: high
tags:
- attack.t1628.001
- attack.persistence
author: Vorant

Sideloaded APK Install Outside Google Play With Install-Unknown-Sources Flag

ATT&CK T1476

Detects package installation via the Android package manager where the installer is not the Google Play Store, consistent with delivery of malicious APKs through phishing pages impersonating legitimate apps (e.g. fake Booking.com update pages). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Sideloaded APK Install Outside Google Play Store
id: 2100cbc9-0782-5d0e-b3fb-a58e7be19f6b
status: experimental
description: 'Detects execution of package manager install commands where the installing
  package is not the official Google Play Store (com.android.vending), indicating
  a sideloaded APK. Cifrat and similar Android RATs are distributed via phishing pages
  that instruct victims to install APKs directly, bypassing Play Protect.

  '
logsource:
  category: process_creation
  product: android
detection:
  selection:
    Image|endswith: /pm
    CommandLine|contains: install
  filter_playstore:
    CommandLine|contains: com.android.vending
  filter_adb_debug:
    CommandLine|contains: -i com.google.android.packageinstaller
  condition: selection and not (filter_playstore or filter_adb_debug)
falsepositives:
- Developer sideloading of in-house or test applications via ADB
- Enterprise MDM push-installs of managed applications from alternative app stores
level: medium
tags:
- attack.t1476
- attack.initial_access
author: Vorant

Device Admin Activation Used for Uninstall Protection on Android

ATT&CK T1629

Detects activation of Device Administrator or Device Owner privileges shortly after a non-system app install, a technique used by Android RATs like Cifrat to block uninstallation and impair defensive removal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Device Admin Activation for Uninstall Protection
id: 29fbd2e9-da5c-55b0-a506-29dedd03db85
status: experimental
description: 'Detects shell commands activating Device Administrator or Device Owner
  privileges for an application package, which Android RATs (including Cifrat) use
  to implement uninstall protection and impair removal by the user or defensive tools.

  '
logsource:
  category: process_creation
  product: android
detection:
  selection:
    CommandLine|contains:
    - dpm set-device-owner
    - dpm set-active-admin
    - set-device-owner
  filter_mdm:
    CommandLine|contains:
    - com.google.android.apps.work
    - com.microsoft.intune
    - com.airwatch
  condition: selection and not filter_mdm
falsepositives:
- Legitimate enterprise MDM enrollment (Intune, AirWatch, Workspace ONE) setting device
  owner
- IT-managed provisioning of corporate devices
level: medium
tags:
- attack.t1629
- attack.defense_evasion
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/cifrat-analysis

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free