An Android trojan is impersonating Bahrain's official emergency alert app to take over phones and drain the credentials stored on them. Researchers at K7 Labs, in an analysis published by Baran S, track the malware as Octagon and found a campaign aimed almost entirely at users in Bahrain.
The lure is a fake copy of BH Alert, the country's civil defense notification app. Victims are pushed to phishing pages hosting BH-Alert[.]apk, and once the app is installed it adopts an icon resembling the government's MyGov Bahrain app so it blends into the phone's app drawer. On first launch it walks the victim through a seven step setup wizard whose only real purpose is to collect the permissions it needs.
What it steals
Two of those permissions do the damage. The first is VPN access. Once granted, Octagon opens a tunnel that intercepts and redirects the device's traffic, which K7 says facilitates the exfiltration of banking credentials and other sensitive information. To avoid arousing suspicion, the malware keeps an allow list of apps that are deliberately excluded from the tunnel so they keep working normally.
The second is Android's Accessibility Service, a feature built to help users with disabilities that can read what is on screen and observe input. Octagon abuses it to monitor lock screen events and capture the victim's PIN, password or unlock pattern as it is entered, writing each one to a file named captured_passwords.json with a credential type, a confidence level and a timestamp. It keeps a rolling history of the 200 most recent captures. A local SQLite database (octagon_ward.db) holds intercepted SMS messages, phishing templates, the list of targeted apps and data still queued for the operators, so collection survives network interruptions.
How it hides
Octagon is deliberately hollow when inspected at rest. Its AndroidManifest.xml declares services and activities that are absent from the code packaged in the APK, because the real payload ships as an encrypted asset (ZfChs.ttf). At runtime the malware decrypts it with an RC4 based routine, writes out ZfChs.dex and loads it dynamically, at which point the missing classes appear. K7 confirmed the behavior by instrumenting the app with Frida.
A second stage goes further. An embedded payload is streamed straight from the app's assets into an Android PackageInstaller session and installed in memory, so no standalone APK file is ever written to disk first. The resulting child app, com.kisa.octagonpanel, drops and loads another archive and carries the core surveillance features. For persistence it registers a fake account called OctagonPanel and abuses Android's sync adapter framework so the operating system itself wakes the malware every 30 minutes, which is far quieter than a background service that never stops. Its operational settings, including the command and control address and an anti removal configuration, sit in a preferences file named octagon.xml.
What you should do
Install government apps only from official listings on Google Play or the App Store, never from a link in a message. Treat any app that asks to set up a VPN profile or to be granted Accessibility access as a red flag unless you know exactly why it needs them, and audit both permission lists periodically. K7 says its mobile product detects these samples. The full technical breakdown and indicator list is in the original report.
The playbook is not unique to this campaign. We covered a comparable abuse chain in RedHook, an Android trojan that turned debugging tools into a takeover path, and the wider picture for the country sits on our Bahrain profile.
Indicators of compromise
- Packages: com.kit.kitty (MD5 9694294addbe58be93ddbb6cabc499ce) and com.kisa.octagonpanel (MD5 58330aaf1f533e9fe03b6355c60347b4)
- Command and control: 209[.]99[.]184[.]50 on port 4444
- Distribution: hxxps://download[.]alertbh[.]info/BH-Alert[.]apk, hxxps://bh-alert[.]com/assets/BH-Alert[.]apk, hxxps://playgoogle[.]bh-alert[.]com
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.