How black-hat hackers spy on any android phones using Evil Droid

Evil-Droid is an Android-focused framework designed to generate and embed Metasploit payloads into APK files. Its public source code describes it as a framework for creating, generating, and embedding APK payloads to penetrate Android platforms.

Why is it dangerous?

The main concern is that Evil-Droid can turn an otherwise legitimate-looking Android application into a trojanized application containing a remote-access payload.

At a high level, an attacker could:

Legitimate APK → payload embedded → modified APK → victim installs it → payload communicates with attacker-controlled infrastructure

The framework's source code shows that it can request numerous sensitive Android permissions, including access related to SMS, contacts, location, microphone, camera, phone state, storage, and call logs.

That creates several risks:

• Remote access: A successful payload connection can provide an attacker with an interactive session on the compromised device.
• Data exposure: Sensitive information stored on the device can potentially become accessible.
• Privacy invasion: Capabilities involving the camera, microphone, location, contacts, SMS, and call information can expose highly personal information.
• Persistence: The project contains Android boot-related components, allowing malicious functionality to attempt to remain active after device restarts.

Trojanized applications: Evil-Droid can work with an existing APK and embed a payload into it, making supply-chain/social-engineering scenarios particularly concerning.

How to configure and the attack chain

1? - Download the tool from github
     git clone https://github.com/M4sc3r4n0/Evil-Droid.git

2? - Set script execution permission
     cd Evil-Droid
     chmod +x evil-droid as “scrubbing” payload contents to avoid antivirus signatures, including renaming recognizable package and class names.

1? - Download the tool from github
     git clone https://github.com/M4sc3r4n0/Evil-Droid.git

2? - Set script execution permission
     cd Evil-Droid
     chmod +x evil-droid as “scrubbing” payload contents to avoid antivirus signatures, including renaming recognizable package and class names.

Run Evil-Droid Framework : ./evil-droid

Select option 1 to generate the apk then the malware will automatical

generate the payload this includes setting LHOST, LPORT ,Apk name,the payload.

On the payload select reverse_tcp for advance remote access.

The malware automatically generated the apk .it returns the location of the apk .

The tool automatically launch a Metasploit console and configure a handler for the Android payload. This automates part of the process that would otherwise require manual configuration.

Open the next terminal navigate to a folder where the APK is.To generate a web server so that it could be accessible on the phone.

On the Android navigate to website using kali linux ip address and port.

Download the apk and install it.

The metasploit gained the reverse shell immediately opening the apk.

and sysinfo was used as a proof of exploitation.

According to all malwares i researched i prefer this one because it automatically does everything for me.

Remediation

Users should avoid installing APKs from untrusted or unknown sources and keep Android and security software updated. Organizations should enforce application allowlisting, restrict sideloading where appropriate, monitor for suspicious application behavior and unexpected outbound connections, and use mobile threat detection to identify malicious or trojanized applications. Regular security awareness training can also reduce the risk of users installing socially engineered malicious APKs.