Malware

Elibomi

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence2

We observed an uptick in attacks targeting bank customers in India, the common entry point being a text message with a phishing link. The SMS content urges the victims to open the embedded phishing link or malicious app download page...

T1566.002Spearphishing LinkEvidence2

the common entry point being a text message with a phishing link. The SMS content urges the victims to open the embedded phishing link or malicious app download page

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Elibomi implements a sophisticated and lengthy command list and has three types of commands to conduct malicious activities: Task command, server command, and auto command.

Persistence

2 techniques

T1546.008Accessibility FeaturesEvidence1

the threat actors added automation to workflow tasks via Accessibility permissions such as automated clicking, granting of permissions, and capturing screenshots.

T1556Modify Authentication ProcessEvidence1

Set itself as default SMS app

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

the threat actors added automation to workflow tasks via Accessibility permissions such as automated clicking, granting of permissions, and capturing screenshots.

Stealth

3 techniques

T1036MasqueradingEvidence2

Common among these routines include the abuse of the legitimate banks’ logos, names, and affiliated brands and services to convince victims that their respective phishing sites are affiliated.

T1497Virtualization/Sandbox EvasionEvidence2

This variant added ... an environment check tool called RDVerify for detection evasion.

T1564Hide ArtifactsEvidence1

Elibomi will show a waiting screen after gaining Accessibility permissions for service. However, it already executes an automated workflow in the background to grant sensitive permissions to the attacker.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

Set itself as default SMS app

Credential Access

2 techniques

T1056Input CaptureEvidence2

Elibomi is capable of stealing the pin code or pattern saved by the user by showing an overlay screen to the victim and “listening” for the user’s actions to record their gestures and clicks.

T1556Modify Authentication ProcessEvidence1

Set itself as default SMS app

Discovery

2 techniques

T1069Permission Groups DiscoveryEvidence1

Get all accounts SCREENSHOT GLOBAL_ACTION_BACK

T1497Virtualization/Sandbox EvasionEvidence2

This variant added ... an environment check tool called RDVerify for detection evasion.

Collection

4 techniques

T1005Data from Local SystemEvidence1

It is used to steal PII and credit card information... AxBanker also requests SMS permissions and uses phishing pages to collect the victim’s personal data and credit card information.

T1056Input CaptureEvidence2

Elibomi is capable of stealing the pin code or pattern saved by the user by showing an overlay screen to the victim and “listening” for the user’s actions to record their gestures and clicks.

T1113Screen CaptureEvidence1

When the attackers get the Accessibility permissions granted and receive the task command MEDIAPROJECTION, Elibomi will generate the auto command ... to click on “START NOW” in the MediaProjection dialog box.

T1114Email CollectionEvidence1

Read or delete emails from Gmail GMAILSEQUENCE

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence2

This variant added the cloud-hosted real-time database Firebase as an alternative command and control (C&C) server

T1105Ingress Tool TransferEvidence2

Install additional APK and grant permission for the payload DOWNLOADAPK EXECUTORSEQUENCE:::INSTALLAPK

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

This command returns the execution result to the backend server. For example, “D:::Unlock has been executed - ##-##” shows and communicates with the server

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

polyswarmNews

Aug 10, 2026

Phishing and Android Malware Campaign Targets Indian Banks

Android malware used to steal personally identifiable information and credit card data. Variants in this campaign added automated clicking, permission granting, screenshot capture, Firebase-based C2, and RDVerify-based evasion.

trendmicro comNews

Nov 7, 2022

Massive Phishing Campaigns Target India Banks’ Clients | Trend Micro (US)

Android banking trojan used in phishing campaigns targeting Indian bank customers. It steals PII and credit card data, abuses Accessibility permissions to automate clicks and permission grants, captures screenshots, can unlock devices, disable protections, install additional APKs, and exfiltrate data via backend servers including Firebase-based C2.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Elibomi

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence2

T1566.002Spearphishing LinkEvidence2

the common entry point being a text message with a phishing link. The SMS content urges the victims to open the embedded phishing link or malicious app download page

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Elibomi implements a sophisticated and lengthy command list and has three types of commands to conduct malicious activities: Task command, server command, and auto command.

Persistence

2 techniques

T1546.008Accessibility FeaturesEvidence1

the threat actors added automation to workflow tasks via Accessibility permissions such as automated clicking, granting of permissions, and capturing screenshots.

T1556Modify Authentication ProcessEvidence1

Set itself as default SMS app

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

the threat actors added automation to workflow tasks via Accessibility permissions such as automated clicking, granting of permissions, and capturing screenshots.

Stealth

3 techniques

T1036MasqueradingEvidence2

Common among these routines include the abuse of the legitimate banks’ logos, names, and affiliated brands and services to convince victims that their respective phishing sites are affiliated.

T1497Virtualization/Sandbox EvasionEvidence2

This variant added ... an environment check tool called RDVerify for detection evasion.

T1564Hide ArtifactsEvidence1

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

Set itself as default SMS app

Credential Access

2 techniques

T1056Input CaptureEvidence2

Elibomi is capable of stealing the pin code or pattern saved by the user by showing an overlay screen to the victim and “listening” for the user’s actions to record their gestures and clicks.

T1556Modify Authentication ProcessEvidence1

Set itself as default SMS app

Discovery

2 techniques

T1069Permission Groups DiscoveryEvidence1

Get all accounts SCREENSHOT GLOBAL_ACTION_BACK

T1497Virtualization/Sandbox EvasionEvidence2

This variant added ... an environment check tool called RDVerify for detection evasion.

Collection

4 techniques

T1005Data from Local SystemEvidence1

It is used to steal PII and credit card information... AxBanker also requests SMS permissions and uses phishing pages to collect the victim’s personal data and credit card information.

T1056Input CaptureEvidence2

Elibomi is capable of stealing the pin code or pattern saved by the user by showing an overlay screen to the victim and “listening” for the user’s actions to record their gestures and clicks.

T1113Screen CaptureEvidence1

T1114Email CollectionEvidence1

Read or delete emails from Gmail GMAILSEQUENCE

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence2

This variant added the cloud-hosted real-time database Firebase as an alternative command and control (C&C) server

T1105Ingress Tool TransferEvidence2

Install additional APK and grant permission for the payload DOWNLOADAPK EXECUTORSEQUENCE:::INSTALLAPK

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

This command returns the execution result to the backend server. For example, “D:::Unlock has been executed - ##-##” shows and communicates with the server

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

polyswarmNews

Aug 10, 2026

Phishing and Android Malware Campaign Targets Indian Banks

trendmicro comNews

Nov 7, 2022

Massive Phishing Campaigns Target India Banks’ Clients | Trend Micro (US)

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.