New Snowblind Android trojan examined

Intrusions with Snowblind involved the injection of a seccomp filter to intercept system calls, as well as a SIGSYS signal handler to direct anti-tampering code to unchanged APK versions allowing the deactivation of several app security features.

android android trojan apk app application security code deactivation features filter injection intercept seccomp security security features signal snowblind system tampering threat intelligence trojan