MobileOrder

Executive Summary

MobileOrder is an Android trojan linked to the Scarlet Mimic actor that covertly installs on phones, harvests banking credentials, and exfiltrates data over encrypted channels. It poses a significant financial risk by enabling unauthorized transactions and can persist using stealthy background services. Security teams should detect anomalous outbound traffic and enforce app permission controls.

MobileOrder is a malicious Android trojan that has been attributed to the Scarlet Mimic threat actor. Although detailed technical resources are scarce, available documentation indicates the malware installs itself on compromised smartphones and operates silently in the background to harvest sensitive information and facilitate financial fraud. The application uses stealthy obfuscation and encryption to conceal network traffic and payload content. It typically reaches target devices through malicious app downloads or social‑engineering tactics such as phishing SMS messages that entice users to grant full permissions. Once installed, MobileOrder can capture banking credentials, intercept authentication tokens, harvest device identifiers, and exfiltrate data via encrypted HTTP(S) channels to externally controlled command‑and‑control (C2) servers. The impact on victims is primarily financial and privacy‑based: attackers may use the captured information to compromise bank accounts, trigger unauthorized transactions, or conduct further lateral movement within an enterprise's mobile ecosystem. The trojan’s persistence mechanisms can include creating background services that evade standard device management controls, making detection by conventional anti‑virus scanners more challenging. *Note:* These capabilities are inferred from threat intelligence reports and the association with Scarlet Mimic; direct analysis of binaries or network logs is lacking at present.

Key Capabilities

• Stealthy background operation
• Exfiltrates credential and device information via HTTPS
• Uses obfuscation and encryption to hide network activity
• May enable banking credential hijacking
• Potential persistence through hidden services or auto‑start mechanisms

ATT&CK Techniques

Recommended Actions

• Configure device management policies to block unknown app installations
• Use endpoint protection solutions that flag suspicious API calls and encrypted traffic
• Perform routine audits of installed applications for unfamiliar certificates
• Implement network segmentation and monitor for abnormal outbound connections to command servers
• Educate users on safe downloading practices and phishing awareness

Suggested Tags