Chinese hackers deploy malware that infected over 11,000 Android devices worldwide; Morocco tops targets in Africa

A newly published report from cybersecurity firm Cleafy has revealed that a Chinese-speaking hacker group has developed a powerful malware called PlayPraetor, which has infected more than 11,000 Android devices worldwide in under three months.

Morocco ranks as the top African country targeted, accounting for about 22% of all cyberattacks on the continent.

According to the report, approximately 58% of the malware’s victims are based in Europe, particularly in Portugal, Spain, and France, followed by America (12%) and Asia (8%), with Hong Kong leading the affected regions in the latter.

PlayPraetor operates under the Malware-as-a-Service (MaaS) model, enabling not only theft of sensitive data such as bank account credentials and cryptocurrency wallets but also allowing affiliated hackers to remotely control infected devices. This makes PlayPraetor a scalable fraud platform.

How It Works

Cleafy experts explained that the cybercriminals disguise their malware as legitimate apps—such as Chrome browsers or banking apps—often mimicking the official Google Play Store interface. Once a user downloads and installs the fake application, PlayPraetor activates and requests Android Accessibility Services permissions, which grant full control over the device.

Once permission is granted, the malware connects to the hacker group’s command-and-control (C2) server, allowing it to:

• Collect sensitive data including contacts, SMS, passwords, and screenshots

• Perform overlay attacks by displaying fake login screens on banking apps to harvest credentials

• Execute on-device fraud, mimicking user behavior to carry out transactions or send messages

• Control the device remotely

Expanding Threat Landscape

The report noted a recent shift in focus toward users who speak Spanish, especially in Spain and Latin America, as well as a growing number of French-speaking and Arabic-speaking victims. The emergence of Arabic-speaking victims, experts say, could indicate a new front in the malware campaign.

Cybersecurity professionals warn that PlayPraetor is rapidly evolving, making it one of the most dangerous dynamic threats to the global financial ecosystem. Users are advised to:

• Download apps only from the official Google Play Store

• Exercise caution when granting Accessibility permissions

• Report any unusual login screen changes, especially in banking apps