Reverse Engineering an Android Banking Trojan: “Blackhole VPN,” DEX Anti-Analysis & SMS OTP Theft

[u/mr_anjaneyam]

Investigated a two-stage Android malware campaign disguised as a Telugu wedding invitation. The analysis covers malformed DEX anti-analysis, a “Blackhole VPN” network disruption mechanism, second-stage APK delivery, banking credential phishing, SMS OTP exfiltration, and USSD-based call forwarding.

Full technical breakdown: https://medium.com/@mr.anjaneyam/behind-the-lure-reverse-engineering-an-android-sms-stealer-blackhole-vpn-dropper-and-banking-83e7c3e41e59