In the wake of our recent discovery of the FjordPhantom malware, we have identified a new, sophisticated Android malware named “Snowblind.” Unearthed during a malware attack on a financial services customer in Southeast Asia, Snowblind represents a significant leap in mobile malware capabilities. Our collaboration with Promon has revealed that Snowblind uses a groundbreaking technique that exploits the Linux kernel feature seccomp, allowing it to bypass even the strongest anti-tampering mechanisms and perform scalable app attacks.