Security firm Zimperium has released a new report on Hook malware, which was previously disguised as banking trojans and rogue mobile apps. The latest findings reveal that Hook has transformed into a hybrid spyware and ransomware, posing an even greater risk to users.

Why Hook Version 3 Is More Dangerous

The updated variant, Hook version 3, introduces 38 new remote execution commands, bringing the total to 107. Cybercriminals are now using multiple platforms to host and distribute the malware, often disguised as APK files. These include GitHub repositories, phishing websites, and Telegram channels. It is known that different trojans have also been discovered on these platforms.

How the Malware Attacks

Once installed, Hook tricks users into granting permissions via the Android Accessibility Service. If successful, it executes a range of malicious commands. One of the most alarming is a ransomware-style attack that uses urgency and fear to pressure users into sending payments to a specific wallet address.

Other attack methods mimic spyware behavior. For example, Hook can deploy a fake screen lock interface to capture a user’s PIN or unlock pattern. This data can then be used to access apps and banking information.

Permission request screen with instructions to enable an app.
The new Hook 3 malware has evolved into a spyware/ransomware hybrid, with new and more dangerous types of attacks. / © Zimperium Image source: Zimperium

The malware also launches a deceptive HTML page that imitates Google Pay, designed to steal banking credentials such as name, card number, and PIN. Another tactic involves an NFC overlay, which encourages users to tap NFC-enabled cards like transit passes, badges, or payment cards, potentially exposing sensitive data.

Zimperium warns that attackers continue to evolve the malware by adding new code to bypass security measures more effectively.

How to Protect Yourself

This alert highlights the importance of practicing safe app installation habits. Avoid downloading APKs from unofficial sources, and if possible, refrain from installing APKs altogether unless absolutely necessary. Regularly review app permissions and revoke access from suspicious or overly intrusive apps.

But in cases of attacks, you can enable built-in security tools like Advanced Device Protection, which is designed to prevent unauthorized access to your device, like restricting the USB interface, disabling 2G networks, and blocking harmful websites.

Google has been strengthening Android’s defenses by disabling APK installation by default and requiring authentication for app developers. The company plans to expand verification for third-party apps in the coming months.

What steps do you take to keep your Android device secure? Do you install APK files, and if so, how do you verify their legitimacy? Share your tips below; we’d love to hear your approach.