Family: TeaBot

TeaBot is an android banker first seen in January 2021.

TeaBot payload

Accessibility-driven UI automation to self-grant permissions

Locates nodes in the Settings or package-installer user interface by text or view identifier and dispatches synthetic clicks. This lets the application approve its own permission dialogs, complete side-loading, and intercept attempts to reach the uninstall screen without any real user consent.

Android SMS interception and OTP exfiltration

Registers a high-priority SMS_RECEIVED receiver, parses inbound message bodies and aborts the broadcast to hide messages from the user, alongside network exfiltration primitives. This is the standard 2FA/OTP theft pattern used to complete fraudulent transactions.

Boot-triggered restart with disguised foreground service

Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

Encrypted or packed staged payload inside Android package

Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.

Scripted prompt coaching the user to enable Accessibility

Contains step-by-step instructional text walking the victim through enabling an accessibility service. Because Android deliberately makes this flow difficult, malware ships explicit coaching copy; the presence of such a script alongside an accessibility service is a strong abuse indicator.

Silent screen capture via MediaProjection

Acquires a MediaProjection session and pipes the virtual display into an image reader or encoder, enabling continuous capture of everything shown on screen including credentials and one-time codes. Combined with accessibility auto-approval this runs without further user interaction.

Removes its main activity from the application launcher