Loading malware…
Xenomorph is an Android banking trojan first discovered in February 2022 and associated with the Hadoken Security Group. It targets banking, payment, email, and cryptocurrency applications to steal credentials and other sensitive information and facilitate financial fraud. Early campaigns focused on European banking customers, particularly in Spain, Portugal, Italy, and Belgium, with subsequent targeting including Canada. Later configurations expanded to more than 400 banking and financial institutions and included cryptocurrency wallets.
Xenomorph abuses Android Accessibility Services to detect targeted applications and display fraudulent login overlays. It collects device information and installed-application lists, intercepts SMS messages and notifications, and captures one-time passwords and multifactor authentication prompts. Later versions added keylogging, remote gestures and touches, and SOCKS proxy functionality. Xenomorph v3, also tracked as Xenomorph.C, introduced an accessibility-driven Automated Transfer System capable of extracting credentials, checking balances, initiating transactions, obtaining authentication tokens, and completing transfers without human operator interaction. This version also steals authenticated session cookies through an Android WebView and transmits them to command-and-control infrastructure.
Distribution has included malicious applications on Google Play masquerading as cleaners and productivity tools, along with the GymDrop and BugDrop droppers. Zombinder campaigns embedded delivery functionality into otherwise operational Android applications and prompted users to install purported updates, including fake Google Play Protect updates. Other campaigns used malicious advertisements leading to imitation application-download websites. Xenomorph can impersonate a Google service, obtain device-administrator privileges, and obstruct attempts to disable those privileges or uninstall it. Observed implementations protect payloads and command-and-control information with encryption and obfuscation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These new campaigns feature a new and improved version of Xenomorph, which added RAT capabilities thanks to the addition of a handful of... 'Runtime modules'.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
It was distributed through a fake one-page website containing only two buttons... the “Download for Android” button leads to downloading samples of Ermac... modified legitimate application was downloaded from malicious website mimicking the original website of the application. Victim is navigated there through malicious advertisement.
The malware will periodically poll for new commands from the C2, receiving the following response: { "type" : "get_coms" , "coms" : [ "<COMMANDS>" ] }
Xenomorph, just like the other malware families previously mentioned, starts a browser with JavaScript interface enabled.
DexClassLoader is used in a single place... This method loads dynamically the decrypted payload stored on the filesystem in “filename”
Here the banking payload has the Telegram page link encoded with RC4 encryption... ThreatLabz also observed RC4 encoded C2 domains stored inside the code.
after installation, the bot will always request overlays from the C2, which will send back an encrypted JSON configuration, with the URLs where the overlays are hosted.
Ermac.C, having the following capabilities... Keylogging... It is worth noting that authors of Xenomorph... enhanced with keylogging functionality
Xenomorph creates an overlay onto legit banking applications to trick users into entering their credentials.
It is also capable of intercepting users’ SMS messages and notifications, enabling it to steal one-time passwords and multifactor authentication requests.
after installation, the bot will always request overlays from the C2, which will send back an encrypted JSON configuration, with the URLs where the overlays are hosted.
This banking malware later reaches out to the command-and-control (C2) servers decoded either via Telegram page content or from a static code routine to request further commands, extending the infection.
Upon successful login, the browser will extract the cookie using the Android CookieManager and will send it to the C2 server
Latest versions of it are enhanced with keylogging functionality, accessibility actions engine as well as SOCKS proxy feature.
When the app is first opened, it reaches out to a Firebase server to get the stage/banking malware payload URL. It then downloads the malicious Xenomorph banking trojan samples from Github.
The screenshots in Figures 6 and 7 below show the C2 retrieval from a Telegram page. Here the banking payload has the Telegram page link encoded with RC4 encryption. Upon execution, the banking payload will reach out to the Telegram page and download the content hosted on that page.
143 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as an Android malware family known to abuse accessibility services, illustrating the threat addressed by Android 17's restrictions.
Mentioned in passing as a mobile banking Trojan.
Android banking trojan embedded in Google Play apps that steals banking credentials, intercepts SMS messages and notifications to capture OTP/MFA prompts, abuses accessibility/device admin privileges for persistence, downloads payloads from GitHub, retrieves C2 information via Telegram or static encrypted routines, and uses overlays on legitimate banking apps to phish credentials.
Android banking malware using an Automated Transfer System (ATS) to bypass MFA and automate fraudulent transactions; steals credentials and data from banking apps and crypto wallets; newer versions steal session cookies; distributed via trojanized apps and a service called 'Zombinder'.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.