The Dark Side of Romance SarangTrap Extortion Campaign

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://zimperium.com/blog/the-dark-side-of-romance-sarangtrap-extortion-campaign
• Blog Title: The Dark Side of Romance: SarangTrap Extortion Campaign
• Suggested Section: generic-methodologies-and-resources/phishing-methodology (add a subpage for mobile-focused phishing/malware distribution)

🎯 Content Summary

Executive Summary

Zimperium zLabs uncovered the SarangTrap extortion campaign delivering over 250 malicious Android APKs and 88 phishing domains (70+ actively distributing) under the guise of dating, cloud-storage and car-service apps. Each Android sample implements an invitation-code gating mechanism: users must enter a code that the app POSTs to its C2 server for validation before any sensitive action ...

🔧 Technical Details

Phishing Domain Distribution: Deploy SEO-optimized domains that mimic legitimate app stores and brands, using localized, emotionally appealing titles to rank on search engines and lure victims into downloading malicious APKs or iOS profiles.

Invitation-Code C2 Gating: Implement an initial login screen requiring a user-entered “invitation code” that is POSTed to the attacker’s C2 server. Only after server validation does the malware request dangerous per...

🤖 Agent Actions

Added comprehensive coverage for mobile-focused phishing and malicious app distribution techniques:

1. Created page mobile-phishing-malicious-apps.md under
   generic-methodologies-and-resources/phishing-methodology/
   • Details SEO-optimized ___domain abuse, invitation-code C2 gating, Android runtime-permission/social-engineering, iOS mobile-config delivery, exfiltration, detection & Frida bypass snippets.
   • Includes MITRE style tactics, defensive tips and references (blog & Luban lib).

2. Updated phishing-methodology/README.md to reference the new section so users can easily navigate to it.

These updates integrate the SarangTrap mobile extortion campaign insights into HackTricks’ existing phishing methodology.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 860
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://zimperium.com/blog/the-dark-side-of-romance-sarangtrap-extortion-campaign

Content Categories: Based on the analysis, this content was categorized under "generic-methodologies-and-resources/phishing-methodology (add a subpage for mobile-focused phishing/malware distribution)".

Repository Maintenance:

• MD Files Formatting: 860 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge