Malware

ZoyaTV

Tracked since Oct 14, 2026 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

6 mentions · peak 3 in a dayToday

Vulns0CVEs used

Actors0Groups

ATT&CK0Techniques

IOCs0Tracked

Type: Dropper
Capabilities: Initial access
Delivery: LureFake update
Platforms: Android

ZoyaTV is an Android dropper and short-drama lure application used to distribute the Hirudo banking Trojan. It presents apparently legitimate entertainment content while facilitating installation of Hirudo as a separate application. The delivery workflow checks whether the payload is installed and displays a fake update prompt to induce installation and permission grants, including access to Android Accessibility services. The separately installed payload requires its own permissions to perform malicious activities.

ZoyaTV serves as a delivery component rather than the banking Trojan itself. Hirudo steals banking credentials, payment PINs, device-unlock information and SMS messages, and supports remote screen viewing and camera access. It also attempts to replace legitimate banking applications with modified copies containing an embedded hooking engine that conceals tampering and undermines security checks. The associated operation has prepared replacements for eight Indonesian banking applications across seven banks.

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Activity feed

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyber security newsNews · Oct 22, 2026New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security ChecksEntertainment-themed lure and dropper used to distribute Hirudo. Its package is com.zoyatv.app; the campaign's lure applications present apparently legitimate content and use fake update prompts to trigger installation of the separate malicious payload.Read more ↗cryptika blogNews · Oct 22, 2026New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks | Cryptika CybersecurityEntertainment-themed lure and dropper associated with Hirudo distribution. It participates in the campaign's deceptive installation chain, which uses fake update prompts to deliver the separate Trojan payload.Read more ↗cysecurity newsNews · Oct 15, 2026Hirudo Android Malware Replaces Banking Apps to Evade Security Checks - CySecurity News - Latest Information Security and Hacking IncidentsShort-drama app identified as a Hirudo delivery vehicle. The loader apps provide expected functionality while using fake update notifications to solicit permissions, especially Accessibility access, supporting installation of modified banking apps.Read more ↗bleeping computerNews · Oct 14, 2026Hirudo Android malware replaces banking apps to evade security checksShort-drama app explicitly described as a loader for Hirudo. It delivers promised content while using a fake update notification to solicit permissions needed by the malware, including Accessibility access.Read more ↗

+2 more in the timeline. Sign up to see them

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Threat actor attributionNamed campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilitiesCVEs this family uses for access and lateral movement.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Malware

ZoyaTV

Tracked since Oct 14, 2026 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

6 mentions · peak 3 in a dayToday

Vulns0CVEs used

Actors0Groups

ATT&CK0Techniques

IOCs0Tracked

Type: Dropper
Capabilities: Initial access
Delivery: LureFake update
Platforms: Android

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Activity feed

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

+2 more in the timeline. Sign up to see them

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Mallory platform

The version that knows your environment.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Threat actor attributionNamed campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilitiesCVEs this family uses for access and lateral movement.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.