Loading threat actor…
Albiriox is an Android banking trojan offered under a malware-as-a-service model and associated with likely Russian-speaking operators. It is designed to provide attackers with extensive control over infected Android devices and to facilitate on-device fraud against financial and cryptocurrency services. The malware has been observed targeting hundreds of applications spanning banking, fintech, payment processing, cryptocurrency exchange, and trading use cases. Albiriox supports credential theft through overlay-based phishing, abuses Android accessibility services to capture screen content and interfere with user interactions, and enables real-time remote operation of compromised devices through a VNC-based access component. Its operators can manipulate screens, mimic system updates or black-screen conditions for stealth, and operate within legitimate user sessions to bypass authentication and fraud-detection controls. The malware is also built to support data theft from infected devices and broader post-compromise interaction. Distribution has relied on social engineering, including fake application storefront pages, SMS lures, and trojanized dropper applications masquerading as legitimate software. The malware uses packing and crypting to hinder static analysis and detection, and its MaaS offering includes a custom builder for customers. Early observed campaigns used German-language lures against users in Austria. Overall, Albiriox represents a financially motivated Android malware operation focused on mobile banking fraud, credential harvesting, remote device control, and defense evasion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Albiriox is an Android malware offered as MaaS, enabling on-device fraud, screen manipulation, and real-time device control. It targets financial and crypto apps, uses social engineering and droppers for distribution, and leverages accessibility services and VNC for remote control and credential theft.
Banking trojan operation targeting Android devices to gain full control, likely for financial theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.