Pakistani APT Exploits YouTube Clones to Infect Android Devices

The APT36 hacking group, also known as Transparent Tribe, has been using fake YouTube apps to infect Android devices with their remote access trojan (RAT), CapraRAT. Once installed, the malware can collect data, record audio and video, and access sensitive information. APT36 primarily targets Indian defense and government entities, as well as individuals involved in Kashmir region affairs and human rights activism in Pakistan. The malicious apps are distributed outside of Google Play and request risky permissions during installation. Despite their weak operational security, APT36's continuous development of new apps allows them to consistently reach new potential victims.