Trojan Calculator & Remote Shell
Active Research BuildAndroid Background Daemon • Dynamic Credential Provisioning • Web Telemetry Bridge
My latest engineering build explores low-level mobile OS internals, background daemon persistence, and socket tunneling. On the surface, the app is distributed as a completely functional, clean calculator and utility torch application with standard arithmetic functions and zero suspicious UI elements.
Under the hood, upon launch it silently initiates a background SSH server daemon on the mobile device. The engine automatically provisions dynamic session credentials (username and password), interrogates local interface routing tables to resolve the device's network IP, and packages this telemetry into an automated exfiltration pipeline.
The app beams the generated payload and SSH connection string up to my private, authenticated web command dashboard. Once I log in to the dashboard, I can extract the dynamic one-liner command and execute it directly from my Linux workstation terminal. This establishes an immediate, low-latency POSIX shell session into the target mobile device across the network—giving full remote command-line execution, filesystem navigation, and process telemetry.