Massiv: Fake IPTV Apps Powering Full Android Device Takeover Fraud

Javier Conejo del Cerro
hace 5 días
3 Min. de lectura

Massiv is a newly identified Android banking trojan designed to enable full Device Takeover (DTO) attacks for financial fraud. Disguised as IPTV applications and distributed via SMS phishing, it grants operators complete remote control over infected devices, allowing them to bypass banking protections and execute fraudulent transactions in real time.

First observed in targeted campaigns in Portugal and Greece — with samples dating back to early 2025 — the threat actor remains unattributed. However, the operational maturity and feature set indicate an advanced mobile fraud operation with potential expansion into broader malware-as-a-service activity.

Phase 1: Social Engineering & Initial Infection

The infection chain begins with SMS phishing campaigns that impersonate IPTV services.

Victims receive links to download what appears to be an IPTV streaming application. The dropper app (e.g., IPTV24) behaves convincingly:

It opens a WebView displaying legitimate IPTV content.
It prompts the user to install an “important update.”
It requests permission to install apps from unknown sources (sideloading).

Once granted, it installs the Massiv payload, often disguised as a fake Google Play component.

No actual IPTV service is compromised — the branding is purely deceptive.

Phase 2: Accessibility Abuse & Stealth Control

After installation, Massiv requests elevated permissions, particularly:

Accessibility Services
MediaProjection API (screen capture)
SMS access
Installation permissions

Through Accessibility abuse, the malware gains near-complete UI interaction control.

To evade user awareness, it can:

Enable a black screen overlay
Mute sounds and vibrations
Clear local logs
Disable visible indicators

Massiv effectively turns the device into a remotely controlled terminal while hiding its activity from the user.

Phase 3: Credential Harvesting & Overlay Attacks

Massiv deploys fake overlays on top of banking and financial applications.

Targets include:

Mobile banking apps
Payment platforms
Portugal’s gov.pt digital ID system

In the gov.pt campaign, overlays prompt victims to enter phone numbers and PIN codes, likely to bypass KYC verification mechanisms such as Chave Móvel Digital.

The malware supports:

Screen streaming
Keylogging
SMS and OTP interception
Clipboard manipulation
UI-tree extraction when screen capture is blocked

The UI-tree technique builds a JSON representation of visible elements (text, coordinates, clickable fields), allowing the attacker to interact programmatically even when screen capture protections are in place.

Phase 4: Full Device Takeover (DTO)

Massiv goes beyond credential theft.

It allows operators to:

Perform click and swipe actions
Unlock devices using pattern input
Install additional APK files
Download overlay ZIP packages
Access battery optimization and device admin settings
Execute remote commands
Upload files

This enables live fraudulent transactions directly from the victim’s device, bypassing behavioral fraud detection systems.

Documented impacts include:

Opening bank accounts in the victim’s name
Creating mule accounts
Money laundering
Fraudulent loan approvals

Massiv transforms compromised smartphones into active financial attack platforms.

Geographic Targeting & Expansion

While early campaigns targeted Portugal and Greece, IPTV-themed droppers have recently affected:

Spain
France
Turkey

The broader Android threat ecosystem surrounding Massiv includes:

Accessibility-based bankers (Crocodilus, Datzbro, Klopatra)
OTP stealers
DTO-focused malware families
Emerging MaaS-style backend integration (API key indicators)

ThreatFabric noted ongoing development, suggesting feature expansion and possible commercialization.

Measures to Fend Off Massiv

To mitigate DTO-focused Android malware:

Block SMS-based APK distribution links
Disable sideloading wherever possible
Monitor abnormal Accessibility and MediaProjection usage
Detect overlay attacks on banking and government apps
Restrict unknown app installation permissions
Enforce Google Play Protect policies
Deploy Mobile Threat Defense (MTD) solutions
Implement Mobile Device Management (MDM) controls
Monitor OTP interception behavior
Detect clipboard manipulation patterns
Educate users about IPTV-themed phishing lures

Mobile telemetry and behavior-based detection are critical for identifying DTO patterns.

Massiv reflects a dangerous evolution in Android banking malware: the shift from passive credential theft to full Device Takeover fraud.

Instead of stealing credentials and replaying them elsewhere, attackers now operate directly from the victim’s device, blending malicious activity into legitimate user behavior. This significantly reduces the effectiveness of traditional fraud detection models.

The campaign demonstrates: