AndroxGh0st
Aliases: Androx, AndroxGhost
- First seen
- 2022-12-01 00:00:00
- Malware type
- credential-stealer, webshell
- Family
- Malware family
- Profile updated
- 2026-07-07 13:08:04
Targeted industries: technology-and-telecommunications retail-and-hospitality
Context
According to Laceworks, this is a SMTP cracker, which is primarily intended to scan for and parse Laravel application secrets from exposed .env files. Note: Laravel is an open source PHP framework and the Laravel .env file is often targeted for its various configuration data including AWS, SendGrid and Twilio. AndroxGh0st has multiple features to enable SMTP abuse including scanning, exploitation of exposed creds and APIs, and even deployment of webshells. For AWS specifically, the malware scans for and parses AWS keys but also has the ability to generate keys for brute force attacks. However, the brute force capability is likely a novelty and is a statistically unlikely attack vector.
Reports & references
- lacework.com — Androxghost The Python Malware Exploiting Your Aws Keys (report)
- malpedia.caad.fkie.fraunhofer.de — Py.Androxgh0St (report)
- web.archive.org — Androxghost The Python Malware Exploiting Your Aws Keys (report)