Princess.apk Android data-stealer cluster disguised as adult and cloud services
Malware ActivityFirst reported
Last updated
Happening score
H score
21
Summary
Hide ▲
Show ▼
A separate Android malware cluster tied to PhantomCaptcha now broadens the threat because it used fake adult entertainment and cloud storage apps to harvest sensitive phone data. One tracked domain, princess-mens[.]click, delivered princess.apk to infected devices. The app collected contacts, media, SIM data, and location details, creating a mobile privacy and abuse risk.
Timeline
-
22.10.2025 18:45 2 articles · 7mo ago
PhantomCaptcha-linked Android malware cluster distributes princess.apk
Campaign Scope UpdateA separate Android malware cluster associated with PhantomCaptcha used princess-mens[.]click to distribute princess.apk through fake adult-entertainment and cloud-storage lures, and the app collected contacts, media, SIM data, and location details from infected Android devices.
Show sources
- PhantomCaptcha Campaign Targets Ukraine Relief Organizations — www.infosecurity-magazine.com — 22.10.2025 18:45
- PhantomCaptcha Campaign Targets Ukraine Relief Organizations — www.infosecurity-magazine.com — 22.10.2025 18:45