TinstaPorn Android Malware Poses as Casino App to Collect User Data
TinstaPorn Android malware disguises itself as a casino app to steal user data.
A malicious Android application named TinstaPorn, identified as Android/TinstaPorn.A!tr, has been discovered posing as a Macau casino app. It exploits gamblers with rigged betting odds while collecting sensitive user data such as phone numbers, precise location information, and device details. The app is developed using the Flutter framework, which can make analysis more challenging, and is supported by a multi-stage server infrastructure that uses AES encryption for its communications.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTinstaPorn is a malicious Android app masquerading as a legitimate Macau casino application, tricking gamblers into installing it by offering rigged betting experiences while covertly exfiltrating sensitive personal data including phone numbers, precise GPS location, and device identifiers. Users fell victim because they sideloaded or downloaded the app outside of official app stores, where vetting controls are absent, and failed to scrutinize app permissions before granting them. The use of the Flutter framework and AES-encrypted multi-stage server communications was deliberately chosen to hinder detection and analysis by security tools. This incident highlights how social engineering through fake utility or entertainment apps remains a highly effective vector for large-scale data harvesting. When users do not understand the risks of unofficial app sources or excessive permission grants, attackers can operate undetected for extended periods.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Android/TinstaPorn.A!tr