Rapid Response: Zimperium Secures Mobile Endpoints Against Octagon Android Malware

Security researchers at K7 Security recently published a technical analysis detailing Octagon, an emerging multi-stage Android Remote Access Trojan (RAT) targeting users through fake government and public safety applications—specifically impersonating the official "BH Alert" Civil Defense app in Bahrain.

While this campaign was only recently named in industry reporting, Zimperium detected and neutralized this threat across customer devices prior to the publication of these reports or IOC disclosures. Our on-device dynamic threat engines recognized the underlying malicious behaviors and zero-day loading mechanisms well before public attribution occurred.

Understanding the Octagon Malware Architecture

Unlike traditional Android RATs that embed their primary capabilities within the main executable, Octagon relies on a modular, multi-stage loading architecture designed to evade static analysis and automated app store scanners.

• Encrypted Dynamic Payload Loading: The primary APK acts as a stub launcher containing missing class declarations in its AndroidManifest.xml. Upon execution, it extracts an encrypted payload disguised as a font file from its assets folder, decrypts it locally using an RC4-based routine, and dynamically loads the secondary binary via DexClassLoader.
• Abuse of Accessibility and System Services: Octagon lures victims through a deceptive 7-step onboarding process, convincing them to grant high-privilege Accessibility Services. Once granted, the malware silently captures on-screen text, logs keystrokes, steals credentials, and interacts with UI elements without user consent.
• Persistent C2 and VPN Hijacking: Beyond standard spyware functions (SMS extraction, contact scraping, and call logging), Octagon establishes persistent communication channels with its Command and Control (C&C) infrastructure and attempts to route device traffic through compromised or custom VPN configurations to inspect and hijack network traffic.

Zimperium Zero-Day Coverage & Protection

Zimperium clients are protected against the Octagon malware family and all associated indicators of compromise (IOCs).

Because both Zimperium’s Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend) rely on on-device, machine-learning models rather than static signature matching, our solution detects the core techniques weaponized by Octagon:

• Dynamic Payload Detection: Zimperium zOS continuously monitors application behavior at runtime. The moment an app attempts to write decrypted DEX code to private storage and dynamically load it, zOS flags the activity as an anomalous dynamic code execution attempt.
• Behavioral & Accessibility Abuse Monitoring: Unauthorized elevation of Accessibility permissions paired with automated UI interactions triggers immediate risk alerts, isolating the threat before data exfiltration occurs.
• Network & Web Protection: Zimperium’s web content filtering blocks connections to known malicious hosting domains and prevents communication with active C2 nodes, neutralizing the attack vector at the perimeter.

Organizations using Zimperium MTD remain automatically protected against Octagon without requiring administrative intervention or engine updates.