Princess.apk Android data-stealer cluster disguised as adult and cloud services
Malware Activity
Summary
Hide ▲
Show ▼
A separate Android malware cluster tied to PhantomCaptcha now broadens the threat because it used fake adult entertainment and cloud storage apps to harvest sensitive phone data. One tracked domain, princess-mens[.]click, delivered princess.apk to infected devices. The app collected contacts, media, SIM data, and location details, creating a mobile privacy and abuse risk.
Related Happenings
Vidar infostealer delivered through TikTok and Instagram Reels
Malware Activity
H score27
First: 10.06.2026 19:00
Last: 10.06.2026 19:00
Sources 1
About this happening:
Threat actors are using **TikTok** and **Instagram Reels** to deliver **Vidar infostealer** through fake free-software tutorials, putting viewers at risk of **credential**, **fina...
Vidar infostealer delivered through TikTok and Instagram Reels
Malware ActivityAbout this happening: Threat actors are using **TikTok** and **Instagram Reels** to deliver **Vidar infostealer** through fake free-software tutorials, putting viewers at risk of **credential**, **fina...
Timeline
-
22.10.2025 18:45 2 articles · 8mo ago
PhantomCaptcha-linked Android malware cluster distributes princess.apk
Campaign Scope UpdateA separate Android malware cluster associated with PhantomCaptcha used princess-mens[.]click to distribute princess.apk through fake adult-entertainment and cloud-storage lures, and the app collected contacts, media, SIM data, and location details from infected Android devices.
Show sources
- PhantomCaptcha Campaign Targets Ukraine Relief Organizations — www.infosecurity-magazine.com — 22.10.2025 18:45
- PhantomCaptcha Campaign Targets Ukraine Relief Organizations — www.infosecurity-magazine.com — 22.10.2025 18:45