🔧 Technical Details

Sideload + WebView phishing pipeline: Distribute an APK outside Play, request REQUEST_INSTALL_PACKAGES, then load staged HTML from assets in a JS‑enabled WebView (kyc.html → debit.html → net.html → pass.html → pin.html) to capture PII, card data, online‑banking creds, transaction password, and ATM PIN. Exfiltrate each submission with a device identifier to Firebase (e.g., formInfo.json).

Foreground audio persistence: Create a NotificationChannel and call startForeground() with an “Audio Playing” notification while looping a silent MediaPlayer. This elevates process priority, bypasses Doze throttling, and resists background kills on modern Android.

Broadcast‑driven auto‑revival: Register exported receivers for boot, screen, power, connectivity, package, and SMS events. On any trigger, verify and restart the core service with startForegroundService() and re‑arm a...

🤖 Agent Actions

I analyzed the blog and the HackTricks repository and identified the best place to integrate the new technical techniques: the existing page “Mobile Phishing & Malicious App Distribution (Android & iOS)” under Phishing Methodology. This page already covers Android phishing, droppers, WebView, FCM, etc., but it lacked specific content on foreground audio persistence, broadcast-driven auto-revival, Firebase Realtime DB exfil structure, telephony hijack via USSD + SmsManager with SIM-slot control, launcher hiding via intent-filter, and covert native crypto-mining on Android—all central to the GhostGrab campaign.

What I did:

• Read relevant files (5+):
  • src/generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.md
  • src/generic-methodologies-and-resources/phishing-methodology/README.md
  • src/generic-methodologies-and-resources/phishing-methodology/detecting-phising.md
  • src/generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.md
  • other phishing-methodology files
• Updated a single file: src/generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.md
• Added a new section “GhostGrab-style Android Stealer + Miner tradecraft (WebView phishing, Firebase C2, foreground audio persistence)” with concise, highly technical abstractions:
  • Sideload + assets/WebView phishing pipeline with Firebase Realtime DB exfil (JS example with fetch to https://<project>.firebaseio.com/formInfo.json)
  • Foreground audio persistence to bypass Doze and background kills (notification channel + startForeground + looping silent MediaPlayer). Code provided in an expandable.
  • Watchdog auto-revival via exported BroadcastReceiver + AlarmManager + startForegroundService; manifest and code sketches in an expandable.
  • Firebase as covert C2: push token via FCM + Realtime DB schema; commands: callForward (USSD *21<NUMBER># / ##21#), sendSms (SmsManager with subscription id), forwardSms with deduplication.
  • SMS scraping via content://sms/ and SIM profiling via SubscriptionManager/TelephonyManager.
  • Launcher/icon hiding by using CATEGORY.INFO instead of CATEGORY.LAUNCHER.
  • Covert mobile crypto-mining pattern: drop/decrypt native miner .so, load with System.load and start with Monero TLS flags using a runtime worker id (example provided).
  • Hunting pointers for detection (foreground “Audio Playing” pattern, USSD **21*/##21#, FCM+Realtime DB keys clients/<DeviceID>, repository, miner artifacts).
• Ensured placeholders between angle brackets aren’t interpreted as HTML by wrapping them in backticks per guidelines.
• Appended the blog URL to the References section.

Changes applied via repo tools:

• Modified: src/generic-methodologies-and-resources/phishing-methodology/mobile-phishing-malicious-apps.md
  • Inserted the GhostGrab techniques section with code/examples and hunting pointers.
  • Added CYFIRMA blog to “References”.

No new files were created. The update maintains HackTricks style, adds concrete code snippets, and includes the required “References” update.

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.