Loading malware…
Marcher is an Android banking Trojan active since at least the mid-2010s and widely associated with credential theft against mobile banking users. It is known for phishing-style overlay attacks that place fraudulent login or payment prompts on top of legitimate banking applications and other trusted Android apps, including app-store interfaces, to capture usernames, passwords, payment-card data, and related verification information. Marcher has also been described as password-stealing malware and has been sold in Russian-language underground markets.
Marcher is delivered through social-engineering-heavy Android sideloading schemes rather than trusted app stores. Observed delivery methods include links sent by SMS and email, phishing campaigns targeting bank customers, fake security or update applications, and lures themed around popular brands or software. Campaigns have instructed victims to enable installation from unknown sources and, in some cases, to grant elevated Android privileges such as device administrator access. It has also appeared in fake update traffic-redirect chains that deliver different payloads depending on device type.
The malware primarily targets Android users of financial institutions, with documented campaigns against banking customers in countries including Austria and Australia. It has also been used to target payment-related workflows by harvesting card data through overlays shown over legitimate applications. Marcher has been linked to broader criminal distribution ecosystems, including Avalanche-hosted malware operations, and to infrastructure overlaps with other financially motivated malware activity.
Marcher is significant in the Android banking-malware lineage because later families such as Exobot and Gustuff were reported to derive from or build on Marcher code or tradecraft. Its long-running use of overlay-based credential theft made it a representative example of mobile input-prompt abuse against banking apps.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
However, if a user was on an Android device, they would be given the same fake update redirect and download instructions, but the payload would be the Marcher banking trojan.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Typically, an attack chain will consist of three parts: the malicious injects served to website visitors, which are often malicious JavaScript scripts; a traffic distribution service (TDS) responsible for determining what user gets which payload based on a variety of filtering options; and the ultimate payload that is downloaded by the script.
The attacks described here begin with a banking credential phishing scheme, followed by an attempt to trick the victim into installing Marcher, and finally with attempts to steal credit card information by the banking Trojan itself.
They sent more than 1 million e-mails with damaging attachments or links every week to unsuspecting victims.
Marcher is frequently distributed via SMS, but in this case, victims are presented with a link in an email. Oftentimes, the emailed link is a bit.ly shortened link, used to potentially evade detection.
The phishing template then presents additional instructions for installing the fake security application... Step 2: Allow installation... check Unknown sources. Step 3: Run installation... tap Install.
From this small sample, we see that 7% of visitors clicked through to download the application, which is actually a version of the Marcher banking Trojan named “BankAustria.apk”.
TA2726 appears to be a traffic seller and operates a TDS that can serve other threat actors to facilitate their malware distribution.
A malicious application could create an application overlay window on top of a running legitimate application.
A malicious application could create an application overlay window on top of a running legitimate application.
Marcher is delivered via a link sent by SMS or email, including instructions advising the user to modify their Android device security settings to enable apps to be installed from "Unknown Sources."
Analysis of the malware shows that it uses the common string obfuscation of character replacement (Figure 7).
The link resolves to a URL designed to appear legitimate, with a canonical domain of sicher97140[.]info including the “bankaustria” brand.
TA2726 appears to be a traffic seller and operates a TDS that can serve other threat actors to facilitate their malware distribution.
The botnet implements all the typical features that banking trojans currently have: overlay injection over mobile banking applications...
The link leads to a phishing page that asks for banking login credentials or an account number and PIN.
In addition to operating as a banking Trojan, overlaying a legitimate banking app with an indistinguishable credential theft page...
Millions of private and business computer systems were also infected with malware, enabling the criminals operating the network to harvest bank and e-mail passwords.
This has been the dominant method in recent years... mimics the bank’s login page and reels in the victim’s credentials.
The actor used filtering to determine what browser the recipient used and downloaded the payload that aligned with their browser.
The botnet implements all the typical features that banking trojans currently have: overlay injection over mobile banking applications...
The link leads to a phishing page that asks for banking login credentials or an account number and PIN.
In addition to operating as a banking Trojan, overlaying a legitimate banking app with an indistinguishable credential theft page...
185.188.204[.]16 IP Marcher C&C
TA2726 appears to be a traffic seller and operates a TDS that can serve other threat actors to facilitate their malware distribution.
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.