Press play to start listening
A fake Macau casino app uses rigged betting odds to exploit gamblers while collecting phone numbers, location data and device information from Android users.
FortiGuard Labs has analysed a malicious Android application called TinstaPorn, which poses as an online version of a famous casino in Macau. Identified as Android/TinstaPorn.A!tr, the app combines rigged gambling games with the collection of users’ personal information.
In its research shared with Hackread.com, FortiGuard Labs explained that despite its name, TinstaPorn has nothing to do with adult content. It offers casino games such as slots and roulette, but the odds are manipulated in the operators’ favor.
FortiGuard did not explain how the games’ outcomes are manipulated, only noting that the mathematical odds benefit the operators. The platform also encourages users to keep spending through VIP balance top-ups, rebates and referral rewards.
Gambling Comes With a Privacy Risk
The financial losses aren’t the only concern here. FortiGuard found that the application collects phone numbers and precise location information. This includes latitude, longitude, location accuracy and timestamps.
It then sends this information to its game servers through specific communication routes, including /loc/geo-location and /bind_phone. It also sends device identification details and other technical information to a separate logging server. This allows operators to recognize and fingerprint individual devices.
When combined, these details can help operators link a person’s phone number and gambling account to their device and physical location. This creates a privacy risk beyond the money users could lose through the rigged games.
Flutter Makes Malware Analysis Harder
TinstaPorn was developed using Flutter, a Google framework that allows developers to build apps for different platforms (iOS, Android, desktop and web) from the same codebase. FortiGuard noted that the framework also makes malware analysis more difficult because its compiled code does not work like that of typical Android applications.
The challenging aspect is Flutter’s use of a different Application Binary Interface (ABI) as it affects how the app’s code interacts with the underlying system. This can make it harder for analysts to examine the app and understand what it does.
FortiGuard researchers also noted that tools have improved since 2024 with new options available, including r2flutter, Bytecode Studio and AI-assisted analysis through r2ai.
A Multi-Layer Backend Keeps the App Running
Researchers also found a multi-stage server infrastructure supporting the gambling platform. The app first contacts configuration files hosted on GitHub and Gitee. These files provide server addresses rather than executable code.
It then registers the device, contacts line configuration servers to obtain available game server addresses, and stores those details in a local SQLite database. If servers become unavailable, the app has hardcoded alternatives to try. It also tests server response times before selecting a game server.
Communications use AES encryption and HMAC-SHA256 signatures to authenticate requests. However, the AES key is supplied in cleartext by the line configuration server. This means, the encryption mainly obscures traffic rather than protecting it from third-party inspection.
FortiGuard Labs researcher Axelle Apvrille described the operation as more than a basic malware project, concluding that “It reflects well-planned development, with a clean infrastructure, multiple REST APIs, and a full ecosystem.”
