https://blog.efespain.com/en/tags/adb/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-17/A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.https://blog.efespain.com/en/chapter-13/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-13/In chapter 10 I caught the miner, but not the thing that hands it out: that part I told on loan, using someone else's analysis. The honeypot holds a grudge, and brought me the whole thing — armoured three times over, with a blob that resisted everything I know how to do. Until I stopped trying to read it.https://blog.efespain.com/en/chapter-10/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-10/Another APK came in through the debug cable, but this one weighs fifteen times less than the last and doesn't carry a single line of native code. I opened it expecting something mediocre. What I found was a 2018 fossil still infecting phones to mine for a company that shut down seven years ago — and which today, without knowing it, warns its own victims.https://blog.efespain.com/en/chapter-7/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-7/The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.