A new variant of the Necro Trojan loader has compromised over 11 million Android devices after infiltrating legitimate applications on the Google Play Store via a compromised advertising framework dubbed Coral SDK. The malicious component was embedded in popular utilities including Wuta Camera (versions 6.3.2.148–6.3.6.148, exceeding 10 million installs) and Max Browser. To evade Play Protect and static signature scanning, Coral SDK beacons to remote command servers and downloads benign-looking PNG files containing encrypted payloads hidden within their ARGB pixel channels.

Once fetched, the SDK extracts the hidden shellcode and executes second-stage DEX bytecode via DexClassLoader. The loader subsequently deploys modular plugins into the host process space to establish hidden WebViews for ad fraud, configure SOCKS5 reverse proxies that tunnel threat actor traffic through victim endpoints, and trigger unauthorized WAP subscription charges. Google purged Max Browser from Play, and Wuta Camera released clean update 6.3.7.138, but enterprise mobile fleets remain vulnerable if infected legacy builds or side-loaded modified APKs persist on user devices.

Why it matters:

• Technical & Architecture Risk: Malicious third-party advertising SDKs execute inside the host application’s security context, allowing adversaries to bypass mobile sandboxing, dynamically load unsanctioned DEX bytecode via steganographic covert channels, and abuse mobile network interfaces as residential proxy relays without requesting elevated Android permissions.
• Strategic & Defender Imperative: Mobile device management (MDM) administrators must audit mobile fleets for unvetted third-party APKs, enforce application version pinning to ensure Wuta Camera is updated to version 6.3.7.138 or later, and restrict untrusted sideloading across enterprise-enrolled Android profiles.