Octagon Android Malware Emerges as a Potent Account Takeover Tool In June 2026, cybersecurity firm iVerify uncovered Octagon, a sophisticated Android malware-as-a-service (MaaS) tool designed to facilitate financial fraud by hijacking user accounts. Sold on Russian-language cybercrime forums by a threat actor known as AndroidKitKat, Octagon is marketed for $1,400 per month and provides attackers with a ready-made control panel to orchestrate theft. The malware exploits Android’s accessibility features to gain deep device control, enabling attackers to monitor screens, capture login credentials, and intercept SMS-based one-time passcodes (OTPs) from banking, cryptocurrency, and messaging apps. By overlaying fake forms on legitimate applications such as Trust Wallet, Binance, and MEXC Octagon tricks victims into divulging sensitive information, including wallet recovery phrases and passwords. Remote operators can then simulate taps, log keystrokes, and exfiltrate data in real time. Octagon spreads through sideloaded apps distributed outside official stores, often disguised as innocuous software (e.g., a launcher or visual novel) or via fake government and Google Play pages. Once installed, the malware evades detection by Google Play Protect, persisting even when the system reports no threats. A related campaign in Bahrain used a four-stage APK chain to deliver the payload, demonstrating the malware’s evolving distribution tactics. Researchers identified three APK variants linked to Octagon, all sharing encrypted command-and-control (C2) connections on port 4444. The malware’s Windows-based control panel allows attackers to monitor app activity, push custom overlays, and manipulate device interfaces. Indicators of compromise (IoCs) include C2 IP addresses (e.g., 45.192.12[.]34), package names like com.kisa.octagonpanel, and SHA-256 hashes of malicious APKs. The discovery underscores the growing threat of accessibility-abusing malware, which bypasses traditional security measures by leveraging user-approved permissions. While platform protections like Google Play Protect remain effective against many threats, Octagon’s reliance on social engineering highlights the risks of granting excessive permissions to untrusted apps.