[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgKCMo0yNXFFoQE-pTAsxHOcBcqg6T4jmmgP91bqAJmE":3},{"article":4,"iocs":41,"watch_terms":45,"solutions":46,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"5dec7b43-712c-4d80-b8b6-f09331c750cf","TinstaPorn Android Malware Poses as Casino App to Collect User Data","tinstaporn-android-malware-poses-as-casino-app-to-collect-user-data-866ed6","A fake Macau casino app uses rigged betting odds to exploit gamblers while collecting phone numbers, location data…","A malicious Android application named TinstaPorn, identified as Android\u002FTinstaPorn.A!tr, has been discovered posing as a Macau casino app. It exploits gamblers with rigged betting odds while collecting sensitive user data such as phone numbers, precise location information, and device details. The app is developed using the Flutter framework, which can make analysis more challenging, and is supported by a multi-stage server infrastructure that uses AES encryption for its communications.","TinstaPorn Android malware disguises itself as a casino app to steal user data.","https:\u002F\u002Fhackread.com\u002Ftinstaporn-android-malware-casino-app-collect-user-data\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Ftinstaporn-android-malware-casino-app-collect-user-data.jpg","2026-11-11T12:50:06+00:00","2026-11-11T13:00:28.968997+00:00",7,[17,20],{"name":18,"type":19},"Flutter","product",{"name":21,"type":22},"Google","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":27,"value":43,"context":44},"Android\u002FTinstaPorn.A!tr","Malware identifier for TinstaPorn",[21,18],{"controls":47,"vendors":123},[48,69,97],{"slug":49,"name":50,"problem":51,"products":52},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[53,61],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":40,"name":70,"problem":71,"products":72},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":98,"name":99,"problem":100,"products":101},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":119,"product_name":120,"url":121,"description":122},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[124],{"slug":125,"name":126,"logo_path":127,"roles":128},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[129],"reported_by",{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":140},"fake-casino-app-harvests-user-data-through-malicious-android-malware","Fake Casino App Harvests User Data Through Malicious Android Malware","TinstaPorn is a malicious Android app masquerading as a legitimate Macau casino application, tricking gamblers into installing it by offering rigged betting experiences while covertly exfiltrating sensitive personal data including phone numbers, precise GPS location, and device identifiers. Users fell victim because they sideloaded or downloaded the app outside of official app stores, where vetting controls are absent, and failed to scrutinize app permissions before granting them. The use of the Flutter framework and AES-encrypted multi-stage server communications was deliberately chosen to hinder detection and analysis by security tools. This incident highlights how social engineering through fake utility or entertainment apps remains a highly effective vector for large-scale data harvesting. When users do not understand the risks of unofficial app sources or excessive permission grants, attackers can operate undetected for extended periods.",[135,136,137,138,139],"MITRE ATT&CK T1disguise: T1444: Masquerade as Legitimate Application","NIST CSF 2.0 PR.AT-01: Awareness and Training","NIST SP 800-53 AC-3: Access Enforcement","GDPR Article 5","CIS Control 9: Email and Web Browser Protections (v8)",{"GDPR Article 5":141,"NIST SP 800-53 AC-3: Access Enforcement":142,"NIST CSF 2.0 PR.AT-01: Awareness and Training":143,"CIS Control 9: Email and Web Browser Protections (v8)":144,"MITRE ATT&CK T1disguise: T1444: Masquerade as Legitimate Application":145},"The covert collection of phone numbers, precise location, and device details without user consent violates the data minimization and lawfulness principles that this article mandates.","Enforcing least-privilege access controls on mobile app permissions would have prevented the app from accessing precise location and device identifiers without justification.","Users lacked awareness of the risks of installing apps from unofficial sources and granting excessive permissions, which targeted security awareness training would directly address.","CIS Control 9 covers blocking access to untrusted content sources; applying equivalent protections to mobile app distribution channels would have reduced exposure to this sideloaded malicious app.","TinstaPorn directly impersonated a legitimate casino application to deceive users into installing malware, which is the core behavior this technique describes."]