Fakemoney
Fakemoney is an Android mobile malware/scam app family identified by Kaspersky as fake investment, payout, and financial-service applications. It is described as phishing/scam malware that tricks users with promises of easy earnings, payments, or financial services and then collects victims’ personal data. Kaspersky repeatedly ranked Trojan.AndroidOS.Fakemoney.v among the most prevalent mobile malware detections: it was identified as the most frequently detected mobile malware family in 2024 by share of attacked users, remained highly prevalent in Q3 2024, and in Q2 2025 Kaspersky reported that Fakemoney activity had decreased but it still held the top position among the most frequently detected mobile malware. In Q3 2025, Kaspersky stated that Triada and Fakemoney were the most popular Trojan families, with Fakemoney accounting for 24.6% among the most widespread Trojans. The malware targets Android users and is associated with social-engineering infection vectors via fake apps rather than a specific named threat actor in the provided content. High-confidence identifiers in the content include the family name Fakemoney and the detection name Trojan.AndroidOS.Fakemoney.v.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Credential Access
1 technique
Credential Access
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android trojan family listed among the top mobile malware detections for the quarter.
Android scam-app trojan family; activity decreased in Q2 2025 but remained highly prevalent in detections; also referenced as behaviorally similar to droppers that open attacker-provided URLs leading to casinos/phishing.
Family of Android investment and payout scam apps that showed the highest activity level in 2024.
An Android trojan family listed among the most frequently detected mobile malware in Q1 2026.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.