Attackers are delivering mobile malware via fake document reader applications on Android, using social engineering to trick users into installing malicious apps that steal data and maintain persistence. The attack vector exploits user trust in productivity tools to bypass security awareness. There is no patch, so the primary workaround is to enforce policies for downloading apps only from trusted official stores, carefully review requested permissions, and educate users on the threat.
A recent campaign highlights how attackers are disguising malware as legitimate document reader applications to target Android users. Victims are lured into downloading seemingly harmless apps that promise to open or manage documents, but instead install malicious code capable of stealing sensitive data, harvesting credentials, and maintaining persistent access to the device. By masquerading as productivity tools, these apps exploit user trust and blend into everyday mobile workflows. The findings underscore how social engineering remains a powerful mobile attack vector and reinforce the importance of downloading apps only from trusted sources, reviewing permissions carefully, and monitoring for unusual device behavior.