Download of Fake Messaging App Update APK

PremiumReviewedSigma · Medium · v1
Category
proxy
Author
HuntRule
Published
2026-06-11
Updated
2026-08-28

What it detects

This rule detects proxy or web download requests for APK files masquerading as updates for popular messaging and social apps. Arid Viper distributed Android spyware as fake update packages such as whatsapp-update.apk, messenger-update.apk, google-play-update.apk and instagram-update.apk. These update-themed APK names impersonate trusted applications to trick users into sideloading spyware.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.