BeatBanker is a dual-mode Android Trojan targeting Brazil that combines cryptocurrency mining (XMRig) with banking fraud capabilities. It spreads via phishing to a fake Google Play Store, uses native code obfuscation, in-memory DEX loading to evade detection, and leverages Firebase Cloud Messaging as a C2 channel while maintaining persistence through silent audio playback and foreground services.
Three malicious PHP packages on Packagist disguised as Laravel utilities were discovered distributing a cross-platform remote access trojan (RAT) capable of compromising Windows, macOS, and Linux systems. The packages—lara-helper, simple-queue, and lara-swagger—achieved limited distribution (29-49 downloads each) before being flagged by security researchers.