A sophisticated variant of the Mandrake Android malware has reemerged on the Google Play Store, successfully evading detection for up to two years. Originally notorious for targeting users in 2020, the latest iteration of Mandrake managed to infect thousands of devices, primarily in Western countries, through five different applications.
Researchers from Kaspersky uncovered this new Mandrake campaign, which utilized advanced obfuscation techniques, certificate pinning, and sandbox evasion to fly under Google’s radar. The affected apps collectively amassed over 32,000 downloads and remained available on the Google Play Store for around a year before they were identified and removed.
This new discovery highlights the increasing sophistication of mobile threats despite tighter security measures on app distribution platforms. In response, Google has taken down the compromised apps and is working on enhancing Google Play Protect to better detect such threats in the future.

Collections

A sophisticated version of the Mandrake Android malware evaded Google Play Store security for up to two years, infecting thousands of devices via five different apps. Researchers from Kaspersky found that the malware used advanced techniques like obfuscation, certificate pinning, and sandbox evasion, accumulating over 32,000 downloads before removal. Google has since taken down the affected apps and is working on improving Google Play Protect.

Mandrake Spyware Eludes Google Play Security for Two Years