The Necro Trojan is a type of malware that acts as a loader, meaning it can download and execute additional malicious components once it infiltrates a device. Initially discovered in 2019, the Trojan has evolved, integrating advanced features that enhance its evasion techniques and capabilities. The Trojan cleverly hides its malicious payload within seemingly innocuous images, making it difficult to detect using traditional security methods. This technique allows the malware to bypass standard security checks.

Once activated, the Necro loader can:

• Download and execute DEX files, which are compiled Android code.
• Install additional malicious applications on the device without user consent.
• Intercept sensitive information and transmit it to a command and control (C2) server operated by the attackers.
• Display and interact with advertisements in invisible windows, potentially generating revenue for the attackers.
• Open arbitrary links and execute JavaScript code, which can further compromise user security.