Morpheus A new Spyware linked to IPS Intelligence

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://osservatorionessuno.org/blog/2026/04/morpheus-a-new-spyware-linked-to-ips-intelligence/
• Blog Title: Morpheus: A new Spyware linked to IPS Intelligence
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new/expanded pages around: Accessibility Services abuse + overlays/UI redressing; Wireless Debugging/ADB pairing abuse for local privilege-like capabilities; Android persistence with Device Admin and OEM battery-killer bypass/MIUI locked_apps)

🎯 Content Summary

Morpheus: A new spyware linked to IPS Intelligence (post date: 23 April 2026)

### 1) What it is / impact (why it’s severe)
The post analyzes a previously unknown Android spyware dubbed “Morpheus” (stage-2 agent: com.android.core, versionCode="1", versionName="2025.3.0"). It does not rely on 0-days; instead it uses social engineering plus abuse of legitimate Android features (Accessibility, overlay windo...

🔧 Technical Details

Staged dropper install to deliver an embedded APK and bypass Android 13+ “Restricted Settings” for Accessibility:
Embed the real payload APK inside a first-stage installer (e.g., /assets/mobile-config.apk). The dropper checks whether the target package (e.g., com.android.core) is already installed, copies the embedded APK to storage if not, then triggers installation when the victim grants REQUEST_INSTALL_PACKAGES + READ_EXTERNAL_STORAGE or when a specific external intent action is received (e.g., action_gustavo). This staging can help obtain privileges otherwise blocked for sideloaded apps, notably Accessibility under Android’s “Restricted Settings”.

Overlay + Accessibility “workflow engine” for reliable UI automation and deception:
Combine SYSTEM_ALERT_WINDOW overlays (rendered above apps and system UI) with an Accessibility Service that performs deterministic step sequences (...

🤖 Agent Actions

I’m mapping the Android/mobile sections first, then I’ll read several nearby pages before deciding where a single update fits best.
I’ve narrowed this to Android app pentesting pages. Next I’m reading the most relevant existing docs to see whether this is already covered and whether one page can absorb the new material without duplication.
The existing coverage is broad, but I still need to check whether the specific chain here is already documented: Android 13 restricted-settings bypass via staged installer, wireless-debugging local pairing abuse, and OEM persistence via MIUI locked_apps.
There’s already generic coverage for PackageInstaller-session restricted-settings bypass in the phishing methodology page, so I’m checking whether the missing value is the concrete Accessibility-to-local-ADB chain and the OEM persistence commands rather than repeating the dropper story.
Google search is rate-limited in this environment. I’m switching to direct/Brave-based lookups for primary Android references and will proceed once those are confirmed.
I’ve isolated the gap: HackTricks already mentions staged droppers and generic restricted-settings bypass elsewhere, but this page is missing the concrete Accessibility-to-wireless-ADB escalation, biometric prompt redressing, and OEM persistence steps from the Morpheus chain. I’m patching those into the accessibility abuse page so the new content stays technical and non-duplicative.
The patch is in. I’m reading the updated section and diff now to catch style issues, accidental duplication, or anything that should be tightened before I stop.
Updated accessibility-services-abuse.md as the single target file.

The added material focuses on what was missing from HackTricks rather than repeating existing dropper/accessibility basics: biometric prompt UI redressing, Accessibility-to-Wireless-Debugging/ADB escalation for shell-level abuse, and OEM persistence tricks such as MIUI locked_apps pinning and battery-killer bypass patterns. I also appended the Morpheus blog and primary Android/AOSP references to the file’s ## References section.

Verification: reviewed the final diff and file tail; only this one file changed, references remain at the end, and the HackTricks banner include is preserved. No automated tests were run since this is a markdown-only change.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://osservatorionessuno.org/blog/2026/04/morpheus-a-new-spyware-linked-to-ips-intelligence/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new/expanded pages around: Accessibility Services abuse + overlays/UI redressing; Wireless Debugging/ADB pairing abuse for local privilege-like capabilities; Android persistence with Device Admin and OEM battery-killer bypass/MIUI locked_apps)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0