The malware uses a custom protocol designed to mimic HTTPS traffic, adding another layer of stealth. Organizations should also educate users on social engineering tactics and implement strict security policies to prevent such malware infections. Once installed, the malware requests excessive permissions, including access to contacts, storage, and SMS, allowing it to exfiltrate sensitive data. Its core functionality relies on a native library that exfiltrates device information, contact lists, and SMS messages to a command-and-control (C2) server using an encrypted communication protocol.