Octagon A New Android Bot Targeting Crypto Wallets and Banki...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps
• Blog Title: Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse

🎯 Content Summary

Overview

Published on August 13, 2026, the research analyzes Octagon, a previously undocumented Android on-device fraud bot identified by iVerify in June 2026. The malware is sold as malware-as-a-service for $1,400 per month by the Russian-speaking actor AndroidKitKat, cybercrime-forum member ID 221700. The first sales evidence dates to June 1, 2026, and version 1.2 was announced on June ...

🔧 Technical Details

Accessibility-driven on-device fraud: A malicious sideloaded Android application registers an accessibility service and socially engineers the victim into enabling it. The service can inspect foreground-package UI trees, read displayed data, enumerate interactive nodes, launch applications, and automate clicks, swipes, text input, and global Android actions. Transactions performed through the victim's real device may inherit its trusted-device reputation and existing authenticated sessions.

Package-specific HTML overlay phishing: Malware monitors the active package through accessibility and overlays the legitimate application with attacker-controlled HTML in a WebView. The fake interface collects passwords, PINs, wallet seed phrases, or other secrets. Submitted values cross a JavaScript/native bridge such as OctagonBridge, are serialized into records such as WardGateAnswer, and are sent to C2. Templa...

🤖 Agent Actions

Updated:

src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md

Added concise technical coverage of:

• Package-specific HTML overlay gates and JavaScript/native bridges.
• System UI and keyguard credential capture.
• Static-analysis commands for overlay engines.
• Hidden cover-app initialization and layered persistence.
• Runtime protocol overrides and durable build-correlation artifacts.
• Octagon-specific hunting identifiers as a concrete example.
• Numbered inline citations and the iVerify reference.

Validation passed for diff formatting, references, code fences, duplicate content, forbidden sources, and link reachability. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0