Escobar

Escobar is an Android banking trojan identified as a variant of Aberebot that expanded beyond financial credential theft into broader mobile surveillance and device takeover functions. It has been observed masquerading as a legitimate security application and is associated with phishing-overlay theft of login credentials. Escobar targets Android devices and abuses numerous dangerous permissions to harvest sensitive data from infected phones.

Its capabilities include theft of SMS messages, contacts, call logs, notification content, location data, media files, and one-time codes such as Google Authenticator values. Reported functionality also includes keylogging, audio recording, camera capture, remote screen control through VNC-style interaction, sending SMS messages without user awareness, placing phone calls, injecting web content, uninstalling applications, and self-deletion on operator command. These features support both banking fraud and broader post-compromise surveillance.

Escobar has been advertised in cybercrime forums and linked to the criminal ecosystem around Aberebot, which has targeted customers of numerous banks and financial institutions across multiple countries. Distribution has been assessed as occurring outside the official Android app store, with the malware relying on malicious application delivery and masquerading to induce installation.