Proxies, VPNs and Tor have long helped the privacy community and users in censored regions to fight censorship. However, the same tools can be maliciously exploited by malware and botnets to conceal their communication to external command and control servers. Despite being a critical concern fueled by the proliferation of malware based attacks, no longitudinal studies have analyzed how malware applications use covert channels (CC) to evade detection. We fill this gap by performing the first study of the usage of covert channels in the Android malware ecosystem. To that end, we develop a multistage pipeline that combines static and dynamic analysis to investigate both system and network-level features. We applied this pipeline on a corpus of 3.5M Android malware spanning 2009 to July 2025. Our carefully crafted static validation rules uncovered 288K APKs that used CCs spanning 511 malware families and CC usage growing exponentially from 0.30\% (2012) to 50\% (2025). Overall, in dynamic analysis, we identified 19,308 unique IP addresses being contacted in 85 countries, out of which we were able to explicitly validate the presence of CCs for 59 IP addresses across 17 countries. Further, we performed a longitudinal dataset study spanning over 16 years for CC based malware and found that CC usage has evolved, \textit{e.g.,} some malware adopted by using more than one CCs; others switched between them periodically (one family switched CC usage 40 times from 2019 to 2025).

翻译：代理、VPN和Tor长期以来帮助隐私社区及受审查地区的用户对抗审查。然而，同样的工具也可能被恶意软件和僵尸网络恶意利用，以隐藏其与外部命令控制服务器的通信。尽管恶意软件攻击的泛滥使这一问题成为关键隐患，但目前尚无纵向研究分析恶意应用程序如何利用隐蔽信道（CC）逃避检测。我们通过首次针对安卓恶意软件生态系统中隐蔽信道使用情况的研究填补了这一空白。为此，我们开发了一个结合静态与动态分析的多阶段流水线，用于检测系统和网络层面的特征。我们将该流水线应用于一个涵盖2009年至2025年7月的350万安卓恶意软件语料库。我们精心设计的静态验证规则发现了288,103个使用隐蔽信道的APK，涉及511个恶意软件家族，且CC使用率从2012年的0.30%指数级增长至2025年的50%。在动态分析中，我们共识别出85个国家中19,308个被联系的唯一IP地址，其中明确验证了17个国家中59个IP地址存在隐蔽信道。此外，我们对基于CC的恶意软件进行了跨越16年的纵向数据集研究，发现CC使用方式不断演变，例如：部分恶意软件采用多种CC，其他恶意软件则在多种CC之间周期性切换（其中一个家族在2019年至2025年间切换CC使用达40次）。