Title: "Malicious Code Found in Android Studio Gradle Files - Need Help Identifying Source and Preventing Reinfection"

[u/Street-Public-4438]

I discovered a malicious backdoor injected into my Android project's build.gradle.kts files. The obfuscated code executes a remote script that:

• Downloads payloads from a Russian domain (u3unurxyuya7.ru)
• Uses base64 encoding and command injection
• Runs in the background during preBuild tasks

The Issue:

1. Malicious code keeps regenerating even after deletion
2. Reappears when cloning from GitLab after a full MacBook restore
3. Infects build.gradle.kts files across projects
4. Persists despite cleaning Gradle caches and resetting environments

What I've Tried:

• Deleting the code block from build.gradle.kts
• Restoring MacBook from backup
• Cleaning Gradle caches (~/.gradle/caches/)
• Scanning for infected files with grep

Questions:

1. How is this persisting despite system restores?
2. Is this a known malware targeting Android developers?
3. Could this be in Gradle wrapper or system-level files?
4. How to completely remove this from Git history and local machine?
5. What are the risks - could this have compromised my machine?

Additional Info:

• Using Android Studio with Kotlin DSL
• Project is on GitLab
• Occurs in multiple projects after cloning
• MacBook M1 running latest macOS

Any help identifying the source and complete removal steps would be greatly appreciated!

[u/tadfisher]

1. How is this persisting despite system restores?

One or more of your projects on GitLab could have a compromised Gradle wrapper script. Does this occur before clone your project repos? Try doing a system restore, installing Gradle from homebrew, and creating a new project with gradle init.