Loading story…
Security researchers have identified a new Android banking Trojan, dubbed Herodotus, which employs randomized input delays to evade behavioral detection systems. The malware, advertised on cybercrime forums, introduces pauses of up to three seconds when attackers use accessibility services to input credentials, mimicking the slower, inconsistent typing patterns of human users. This technique is designed to bypass security solutions that flag machine-like input speeds as suspicious, making it more difficult for traditional behavioral biometrics to detect fraudulent activity.
While Herodotus shares many features with other banking Trojans, its unique evasion method poses a challenge for financial institutions relying on input timing as a primary detection mechanism. Researchers from ThreatFabric note that more advanced behavioral biometrics, which model individual user behavior, may still be effective against this threat. The Trojan is poised for use in global campaigns, raising concerns about its potential impact on the finance and banking sector as cybercriminals continue to innovate in bypassing security controls.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
A later report stated that the Herodotus campaign expanded to include Ireland in addition to previously identified targets in the U.S., U.K., Turkey, and Poland. This marked a further geographic escalation of the malware's activity.
Analysis of Herodotus overlay pages and infrastructure showed targeting of financial institutions in the United States, United Kingdom, Poland, and Turkey, as well as cryptocurrency wallets and exchanges. This indicated the operators were preparing for wider international expansion beyond Italy and Brazil.
ThreatFabric publicly disclosed the new Herodotus Android banking trojan, highlighting its randomized input delays that mimic human typing to evade behavioral-biometrics and anti-fraud detection. The report also detailed capabilities including fake banking overlays, screen capture, opaque overlays, remote UI control, and theft of one-time passcodes.
Researchers observed Herodotus in active attacks against users in Italy and Brazil, delivered through smishing and sideloaded dropper apps masquerading as legitimate software. The malware abused Android Accessibility Services to enable device takeover, credential theft, and SMS interception.
ThreatFabric reported that the Android banking trojan Herodotus was being marketed as a malware-as-a-service offering by an author identified as K1R0, who reportedly described it as still under development on cybercrime forums. Researchers also linked it to shared components and techniques associated with Brokewell.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
8 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourcesecurityonline.info
Open sourcethecyberthrone.in
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly discovered Android banking trojan named **Herodotus** is actively targeting devices running Android versions 9 through 16, employing sophisticated techniques to mimic human behavior and bypass security controls. The malware, offered as a Malware-as-a-Service (MaaS) by an operator known as “K1R0,” is designed to allow attackers to take full control of infected phones, enabling them to drain user accounts by evading biometric and behavioral detection systems. Security researchers have observed Herodotus using simulated human typing and interaction patterns to avoid automated detection, making it particularly effective against banking and financial applications. Multiple cybersecurity sources have reported on the emergence and capabilities of Herodotus, highlighting its rapid adoption in the cybercriminal underground and its potential impact on mobile banking security. The malware has been featured in threat intelligence newsletters and technical blogs, with experts warning that its advanced evasion techniques represent a significant evolution in Android malware. Organizations and users are advised to remain vigilant, update their devices, and employ robust mobile security solutions to mitigate the risk posed by this new threat.
Jun 29, 2026
A sophisticated Android banking Trojan, identified as Android/BankBot-YNRK, has been discovered targeting users primarily in Indonesia and potentially other Southeast Asian countries. The malware disguises itself as legitimate applications, including news readers and digital ID apps such as "Identitas Kependudukan Digital," to trick users into installation. Once installed, it leverages Android's accessibility features and device administrator privileges to gain extensive control over the device, allowing it to read on-screen content, simulate user actions, and overlay fake login screens on top of real banking and cryptocurrency apps to harvest credentials. The Trojan employs advanced evasion techniques, such as checking for emulators to avoid detection, obfuscating its code, and muting device notifications to operate stealthily. It connects to a remote command-and-control server to exfiltrate sensitive data, including banking credentials and cryptocurrency wallet keys, and can receive further instructions to update itself or erase traces. The malware's primary objective is financial theft, enabling attackers to drain victims' bank accounts and crypto wallets without their knowledge. Security researchers note that the malware's abuse of accessibility permissions is mitigated in Android 14, which requires explicit user approval for such access, but devices running Android 13 and earlier remain vulnerable.
Jun 29, 2026
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026