Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps

In June 2026, iVerify's threat intelligence team identified Octagon, a previously undocumented Android on-device fraud bot sold as malware-as-a-service (MaaS) by the Russian-speaking actor AndroidKitKat.

The operator advertises Octagon for $1,400 a month, giving buyers accessibility overlays, hidden VNC, SMS and one-time password interception, unlock-pattern capture, and on-screen balance reading. It targets crypto wallets and banking apps after installation, while the delivery app can use an unrelated theme.

Executive summary

Operator and distribution

AndroidKitKat began advertising Octagon on a Russian-language cybercrime forum on June 1, 2026, under member ID 221700. The sales material and panel use English, while backend logs and Telegram history use Russian, consistent with a Russian-speaking developer selling the service internationally. The sales thread establishes how Octagon was marketed, while the panel shows what buyers could do with it.

Figure 1: Sales thread for Octagon, 1 June 2026

Technical analysis

Octagon connects a Windows command-and-control panel to an Android trojan. Compromised devices appear as "Wards," where the operator can inspect applications, read the screen, launch overlays, and control the device.

Figure 2: Octagon panel overview

The builder identifies the Android package as com.kisa.octagonpanel. Its manifest registers WardAccessibilityService through ward_accessibility_config and adds a foreground service that keeps the client running after installation.

Figure 3: Octagon Builder showing AndroidManifest.xml

Once the victim enables accessibility, Octagon reads the interface tree of targeted apps and can place editable HTML WebView overlays over them. Those overlays request a seed phrase, password, or other account data and return the captured values to the panel. The supplied templates include Trust Wallet, Binance, and MEXC, and buyers can add their own.

Figure 4: Trust Wallet in the panel's accessibility node tree

Botnet telemetry and targeting

The panel screenshots show a small set of devices, including what appears to be a current-generation Samsung handset. They capture active testing or an early deployment, although they do not provide a reliable victim count.

Figure 5: Test device information panel

Each device card brings together the installed application list and a balance field, matching the balance-reading capability advertised by the operator.

Figure 6: Panel device card with app list and balance

The device views show where that access is aimed. Crypto wallets and exchanges sit at the center of the workflow, including Trust Wallet, MEXC, MetaMask, Binance, and TON Keeper. Telegram, WhatsApp, and Viber also appear, while the version 1.1 changelog advertises 457 built-in definitions.

Figure 7: Panel balance view showing $2,190.26

Evasion in action

Another screenshot shows how Octagon can continue while the device appears clean. Google Play Protect reports "No harmful apps found" as the malware reads the same screen through accessibility. Its access comes through Android features the victim has been persuaded to enable.

Figure 8: Google Play Protect reporting no harmful apps

Sample analysis

We recovered three APKs attributable to Octagon with high confidence: 

The shared package, Ward and Guardian protocol, encryption code, accessibility configuration, and overlay assets tie all three to the same builder.

package:          com.kisa.octagonpanel
client:           0.2.0
runtime protocol: 3
transport:        AES/GCM/NoPadding
control port:     4444/tcp
passphrase:       octagon-default-key-change-me

Octagon build

Octagon is the most complete build in the set. It connects to 45.192.12[.]34:4444, identifies itself as BUILD_001, and has a valid v2 and v3 signature whose certificate names Octagon. Its persistence stack combines boot restart, a separate :guard process, AlarmManager and WorkManager watchdogs, network and doze recovery, fake account sync, silent audio, and OEM autostart routing. The build can also receive SMS messages, but its configuration skips the SMS permission prompt during onboarding.

BUILD_ID = "BUILD_001"
server_host = "45.192.12.34"
ENABLE_WATCHDOG = true
REQUEST_OEM_AUTOSTART = true
SILENT_AUDIO_KEEPALIVE = true
REQUEST_SMS_PERMISSION = false

For cover, the client loads www.murlauncher[.]com/fenrir-launcher in a hidden WebView and reveals it after WardForegroundService starts.

Lifted Dreams

Lifted Dreams uses the same client with different cover content and onboarding. It connects to 104.251.180[.]179:4444 and asks to read, receive, and send SMS messages. Incoming messages are stored and forwarded as WardSmsReceived, giving the operator access to message content and one-time codes. Its packaged configuration points to 104.251.180[.]179; 209.99.187[.]28 is used only if that configuration cannot be read.

webView.setVisibility(View.INVISIBLE);
webView.loadUrl("https://sandbox-adventure.com/lifted-dreams/game");
stepBattery(); stepSms(); stepA11y();
startForegroundService(WardForegroundService.startIntent(this));
webView.setVisibility(View.VISIBLE);

After requesting permissions and starting WardForegroundService, the client reveals the embedded Lifted Dreams visual novel as its victim-facing cover.

Figure 9: Live Lifted Dreams page used as post-install cover

Underneath the game, the same client remains. Guardian commands can collect screenshots and installed applications, launch apps, push package-specific HTML overlays, and perform clicks, swipes, text entry, and Android global actions. 

Submitted overlay values pass through OctagonBridge and return to the operator as WardGateAnswer records. The same code can capture PINs, passwords, and unlock patterns from Android System UI and common vendor keyguard packages.

One builder artifact appears in every sample: config.json says protocol version 2, while WardForegroundService switches the client to version 3 before connecting. The hosts, cover URLs, signing choices, and persistence settings vary, but the client remains the same.

Dream Group's Bahrain deployment

Dream Group traced a closely related OctagonPanel/Ward payload to users through the BH Alert campaign. BH Alert used Bahrain Civil Defense branding, fake Google Play and government pages, simulated installation screens, and a four-stage APK chain. The final payload shared com.kisa.octagonpanel, the Ward and Guardian implementation, the default passphrase, TCP port 4444, and the Fenrir Launcher URL found in our Octagon build.

Figure 10: Bahrain government lure and delivery chain. Source: Dream Group.

The Bahrain theme gave users a timely reason to sideload the app and grant sensitive permissions. Once installed, the related payload could discover apps, display overlays, collect lockscreen and SMS data, take screenshots, and control the interface.

Detection and mitigation

Across all three samples, we found the same permission flow during installation, encrypted control connection, and identifiers embedded in the client. The hosts and cover content changed between builds, but these behaviors remained consistent. 

Detection can focus on three areas:

1. Installation and permission flow. A sideloaded app requests accessibility, package enumeration, battery-optimization exclusion, wake locks, and foreground execution. Octagon and Lifted Dreams also contain SmsReceiver, although only Lifted Dreams asks for SMS access during onboarding. BahrDate omits it.

2. Network behavior. The client opens an encrypted TCP control connection on port 4444. The destination hosts vary between builds, while the port and default passphrase remain consistent across the three samples.

3. Shared client identifiers. Useful hunting strings include com.kisa.octagonpanel, octagon-default-key-change-me, WardAccessibilityService, OctagonBridge, WARD_GATE_ANSWER, and GUARDIAN_SET_PACKAGE_TEMPLATES. These behaviors and identifiers should outlast individual hosts and cover URLs.

Indicators of compromise