Loading story…
A newly discovered Android banking trojan named Herodotus is actively targeting devices running Android versions 9 through 16, employing sophisticated techniques to mimic human behavior and bypass security controls. The malware, offered as a Malware-as-a-Service (MaaS) by an operator known as “K1R0,” is designed to allow attackers to take full control of infected phones, enabling them to drain user accounts by evading biometric and behavioral detection systems. Security researchers have observed Herodotus using simulated human typing and interaction patterns to avoid automated detection, making it particularly effective against banking and financial applications.
Multiple cybersecurity sources have reported on the emergence and capabilities of Herodotus, highlighting its rapid adoption in the cybercriminal underground and its potential impact on mobile banking security. The malware has been featured in threat intelligence newsletters and technical blogs, with experts warning that its advanced evasion techniques represent a significant evolution in Android malware. Organizations and users are advised to remain vigilant, update their devices, and employ robust mobile security solutions to mitigate the risk posed by this new threat.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
MedImpact disclosed a security incident that took critical systems offline and caused delays in pharmacy claims payouts.
The Canadian Centre for Cyber Security and the RCMP reported multiple incidents in which hacktivists exploited internet-accessible industrial control systems.
Sweden's power grid operator confirmed it had been breached following a public claim by the Everest ransomware group, underscoring continued targeting of European critical infrastructure.
ThreatFabric reported a new Android banking trojan called Herodotus, described as malware-as-a-service sold by an actor using the alias "K1R0" and designed to mimic human behavior to evade bank defenses.
The Maryland Department of Information Technology launched a Vulnerability Disclosure Program to allow legal reporting of security flaws in the state's public-facing systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified a new Android banking Trojan, dubbed **Herodotus**, which employs randomized input delays to evade behavioral detection systems. The malware, advertised on cybercrime forums, introduces pauses of up to three seconds when attackers use accessibility services to input credentials, mimicking the slower, inconsistent typing patterns of human users. This technique is designed to bypass security solutions that flag machine-like input speeds as suspicious, making it more difficult for traditional behavioral biometrics to detect fraudulent activity. While Herodotus shares many features with other banking Trojans, its unique evasion method poses a challenge for financial institutions relying on input timing as a primary detection mechanism. Researchers from ThreatFabric note that more advanced behavioral biometrics, which model individual user behavior, may still be effective against this threat. The Trojan is poised for use in global campaigns, raising concerns about its potential impact on the finance and banking sector as cybercriminals continue to innovate in bypassing security controls.
Jun 29, 2026
A sophisticated Android banking Trojan, identified as Android/BankBot-YNRK, has been discovered targeting users primarily in Indonesia and potentially other Southeast Asian countries. The malware disguises itself as legitimate applications, including news readers and digital ID apps such as "Identitas Kependudukan Digital," to trick users into installation. Once installed, it leverages Android's accessibility features and device administrator privileges to gain extensive control over the device, allowing it to read on-screen content, simulate user actions, and overlay fake login screens on top of real banking and cryptocurrency apps to harvest credentials. The Trojan employs advanced evasion techniques, such as checking for emulators to avoid detection, obfuscating its code, and muting device notifications to operate stealthily. It connects to a remote command-and-control server to exfiltrate sensitive data, including banking credentials and cryptocurrency wallet keys, and can receive further instructions to update itself or erase traces. The malware's primary objective is financial theft, enabling attackers to drain victims' bank accounts and crypto wallets without their knowledge. Security researchers note that the malware's abuse of accessibility permissions is mitigated in Android 14, which requires explicit user approval for such access, but devices running Android 13 and earlier remain vulnerable.
Jun 29, 2026
Multiple new Android malware campaigns have been identified targeting users' financial data and payment methods. Researchers uncovered advanced banking trojans such as BankBot-YNRK and DeliveryRAT, which harvest sensitive information from compromised devices and employ sophisticated evasion techniques, including emulator detection and device-specific targeting. These trojans often masquerade as legitimate apps, such as Indonesia's digital ID application, and can mute device notifications to avoid detection by victims. In addition, a next-generation Android banking trojan has been observed hiding within digital ID apps, automating the theft of cryptocurrency wallets and evading analysis environments. A separate large-scale scam involves over 760 malicious Android apps exploiting NFC and HCE technologies to steal payment card data globally. These apps facilitate unauthorized transactions by leveraging contactless payment features. The surge in Android-targeted financial malware highlights the growing risk to users' banking credentials, payment cards, and cryptocurrency assets, with attackers employing increasingly sophisticated methods to bypass security controls and evade user awareness.
Jun 29, 2026