I discovered a malicious backdoor injected into my Android project's build.gradle.kts files. The obfuscated code executes a remote script that:

  • Downloads payloads from a Russian domain (u3unurxyuya7.ru)
  • Uses base64 encoding and command injection
  • Runs in the background during preBuild tasks
The Issue:
  1. Malicious code keeps regenerating even after deletion
  2. Reappears when cloning from GitLab after a full MacBook restore
  3. Infects build.gradle.kts files across projects
  4. Persists despite cleaning Gradle caches and resetting environments
What I've Tried:
  • Deleting the code block from build.gradle.kts
  • Restoring MacBook from backup
  • Cleaning Gradle caches (~/.gradle/caches/)
  • Scanning for infected files with grep
Questions:
  1. How is this persisting despite system restores?
  2. Is this a known malware targeting Android developers?
  3. Could this be in Gradle wrapper or system-level files?
  4. How to completely remove this from Git history and local machine?
  5. What are the risks - could this have compromised my machine?
Additional Info:
  • Using Android Studio with Kotlin DSL
  • Project is on GitLab
  • Occurs in multiple projects after cloning
  • MacBook M1 running latest macOS

Any help identifying the source and complete removal steps would be greatly appreciated!

submitted by /u/Street-Public-4438
[link] [comments]