Captures every character typed on the screen, including passwords and sensitive messages. Account Hijacking: Specialized modules to steal accounts, as well as Clipboard Hijacker:
Identified by researchers as Mohammed Naser Alfirtosy . Origin: Based in Syria for over 8 years. Cypher Rat Evlf
The Evlf variant provides the attacker with a comprehensive dashboard to control the infected device. Key capabilities include: Captures every character typed on the screen, including
Assuming “Evlf” is a cipher key:
Screen viewing/control, keystroke logging (keylogger), and the ability to download/install additional APKs. keystroke logging (keylogger)