Loading story…
Researchers have identified a sophisticated scam campaign that targets seniors worldwide through Facebook groups promoting social activities, such as dance events, day trips, and community gatherings. The campaign first emerged in Australia in August, with users reporting suspicious Facebook groups that appeared to cater specifically to older adults. Cybersecurity firm ThreatFabric later discovered that the operation had expanded to other countries, including Singapore, Malaysia, Canada, South Africa, and the United Kingdom. The scammers use AI-generated content to make the Facebook group posts appear legitimate and engaging, successfully attracting hundreds of responses from potential victims. Once individuals express interest in the advertised events, the fraudsters initiate private conversations via Facebook Messenger or WhatsApp. During these conversations, victims are directed to fake registration websites that prompt them to download a so-called "community app" to participate in the activities. Instead of a legitimate app, the download link either directly installs the Datzbro Android malware or uses a dropper known as Zombinder to bypass security protections on newer Android devices. Datzbro is a newly emergent Android banking trojan with advanced spyware capabilities, including audio recording, camera access, file theft, and keylogging. The malware also features a remote control mode that allows attackers to exfiltrate on-screen information, steal lock screen PINs, and harvest credentials for financial services such as Alipay, WeChat, and cryptocurrency or bank accounts. The campaign leverages the trust and community orientation of seniors, making them particularly vulnerable to these social engineering tactics. The widespread availability of Datzbro's builder and command-and-control software, following a leak online, has increased the risk of further global proliferation. Security researchers warn that the combination of convincing AI-generated lures and sophisticated malware delivery mechanisms represents a significant evolution in mobile threat campaigns. The use of Zombinder as a dropper enables the malware to evade many standard Android security measures, increasing the likelihood of successful infections. The campaign's global reach and focus on a vulnerable demographic underscore the need for increased awareness and targeted security education for seniors. Financial fraud, device takeover, and credential theft are among the primary risks associated with this campaign. The incident highlights the growing trend of cybercriminals exploiting social media platforms and AI technologies to orchestrate large-scale, targeted attacks. Ongoing monitoring and collaboration between cybersecurity firms and social media companies are essential to disrupt such operations and protect at-risk populations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
ThreatFabric reported that Datzbro had become a broader global threat because its builder and command-and-control software leaked online, lowering the barrier for other criminals to use the malware.
Analysis of the campaign revealed the Android malware Datzbro, delivered directly or through the Zombinder dropper. The malware combines spyware and banking-trojan functions, enabling device takeover, credential theft, and financial fraud.
After its initial detection, the scam was observed targeting users in Singapore, Malaysia, Canada, South Africa, and the U.K. The operation used convincing posts, then moved victims to Messenger or WhatsApp and on to fake registration sites distributing malware.
Researchers first noticed a scam campaign in Australia in August 2025 that used Facebook groups advertising social activities for seniors to lure victims toward malicious Android app installs.
3 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcetherecord.media
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researchers have identified a new Android banking trojan named Datzbro, which is being used in targeted campaigns against elderly individuals. The Datzbro malware is distributed through fake Facebook groups that promote social activities and travel events specifically aimed at seniors. These groups use artificial intelligence-generated content to appear legitimate and attract elderly users seeking companionship and activities. Once a target expresses interest in an event, scammers contact them via Facebook Messenger or WhatsApp, urging them to download a malicious APK file from fraudulent websites such as 'download.seniorgroupapps[.]com.' The websites claim to offer a community application for event registration and member interaction, but in reality, they deliver the Datzbro trojan. The campaign was first detected in August 2025 by ThreatFabric after reports from Australian users, but it has also targeted individuals in Singapore, Malaysia, Canada, South Africa, and the U.K. The attackers have designed their infrastructure to potentially target both Android and iOS users, with placeholder links for iOS TestFlight apps, indicating a broader intent. On Android devices, the malware is sometimes delivered directly or via a dropper created with the Zombinder APK binding service, which helps bypass security restrictions on newer Android versions. Once installed, Datzbro can perform device takeover attacks, allowing threat actors to conduct fraudulent banking transactions and steal sensitive information. The malware is capable of hijacking devices, granting attackers extensive control and access to personal and financial data. The campaign's focus on the elderly makes it particularly concerning, as this demographic is often less familiar with mobile security best practices. The use of AI-generated content and social engineering tactics increases the likelihood of successful infections. Security experts warn that the campaign is ongoing and evolving, with attackers refining their methods to evade detection and expand their reach. The discovery of placeholder iOS links suggests that future campaigns may also target Apple device users. Researchers recommend heightened vigilance for seniors participating in online communities and urge the implementation of robust mobile security solutions. The incident highlights the growing sophistication of social engineering attacks leveraging popular platforms like Facebook to distribute malware. Law enforcement and cybersecurity organizations are monitoring the situation and advising potential victims to avoid downloading applications from unofficial sources. The Datzbro campaign underscores the need for increased awareness and education around mobile threats, especially among vulnerable populations.
Jun 29, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Multiple new Android malware campaigns have been identified targeting users' financial data and payment methods. Researchers uncovered advanced banking trojans such as BankBot-YNRK and DeliveryRAT, which harvest sensitive information from compromised devices and employ sophisticated evasion techniques, including emulator detection and device-specific targeting. These trojans often masquerade as legitimate apps, such as Indonesia's digital ID application, and can mute device notifications to avoid detection by victims. In addition, a next-generation Android banking trojan has been observed hiding within digital ID apps, automating the theft of cryptocurrency wallets and evading analysis environments. A separate large-scale scam involves over 760 malicious Android apps exploiting NFC and HCE technologies to steal payment card data globally. These apps facilitate unauthorized transactions by leveraging contactless payment features. The surge in Android-targeted financial malware highlights the growing risk to users' banking credentials, payment cards, and cryptocurrency assets, with attackers employing increasingly sophisticated methods to bypass security controls and evade user awareness.
Jun 29, 2026