A new Android banking and crypto stealer, ‘Novinarya,’ employs a novel evasion technique by hiding its live command-and-control (C2) server in the bio of a seller’s profile on a legitimate marketplace. This method allows the threat actor to rotate the C2 address with a simple edit, bypassing traditional C2 detection mechanisms. The malware, disguised as a ‘Smart System Security’ app, demonstrates increasing sophistication in mobile malware to maintain persistence and evade analysis.