Thousands of Android malware apps use stealthy APKs to bypass security, study finds
Researchers at Zimperium say attackers are exploiting unsupported compression methods in Android app packages so scanning tools cannot decompile the code.
Security researchers at Zimperium say they have identified 3,300 Android malware samples that use unknown or unsupported compression methods inside their APK files specifically to dodge analysis tools, according to the firm's findings reported by The Hacker News. Of those, 71 were found to be installable on real devices.
An APK is essentially a ZIP archive, and standard decompilation and security-scanning tools expect it to use a small set of known compression algorithms. By packing the file with an algorithm those tools do not recognize, attackers can make the app resist automated analysis while it still installs and runs normally on the device, per Zimperium's research as covered by The Hacker News.
Zimperium began investigating after a June 2023 post from security researcher Joe Security flagged the technique on X, according to The Hacker News' account of the firm's disclosure. The outlet's reporting does not specify how many of the 3,300 samples have been tied to specific malware campaigns beyond the technique itself, and it is not confirmed how widely the tactic has already spread in the wild versus how much is proof-of-concept.
How the evasion works
Fernando Ortega, a security researcher involved in the analysis, described the method as "a technique that limits the possibility of decompiling the application for a large number of tools, reducing the possibilities of being analyzed," according to The Hacker News. Zimperium also found malware authors deliberately corrupting APKs in other ways, including filenames longer than 256 bytes and malformed AndroidManifest.xml files designed to crash analysis software outright, per the same reporting.
The Hacker News reported that the malformed APKs using unsupported compression are not installable on Android versions below 9, but work on subsequent versions of the operating system.
Where the apps are spreading
There is no evidence any of the flagged apps were ever available on the Google Play Store, The Hacker News reported, which points to distribution through untrusted third-party app stores or social engineering that convinces victims to sideload the files directly.
What it signals
The technique itself is not new — The Hacker News noted it was first demonstrated as far back as 2014 — but researchers say they have only recently begun tracking its use at scale. That gap between a known evasion trick and its measured adoption is itself notable: it suggests mobile security tooling built around a fixed set of expected file formats can be blind to a manipulation of the container format rather than the malicious code inside it, regardless of how well that code itself is understood.
US In News compiled this archived account from contemporaneous coverage by The Hacker News. It restores a story originally published on this site in August 2023; figures are as reported at the time.