Loading story…
A new Android malware called Albiriox has emerged, offered under a malware-as-a-service (MaaS) model and targeting over 400 financial, banking, fintech, cryptocurrency, and payment applications. The malware is distributed via dropper apps using social engineering lures, such as fake Google Play Store pages, and employs advanced evasion techniques including packing and integration with third-party crypting services. Once installed, Albiriox enables real-time device control, screen manipulation, and on-device fraud, leveraging a VNC-based remote access module and developing overlay systems for credential theft. Initial campaigns have specifically targeted Austrian users with German-language SMS lures, and the malware's infrastructure and forum activity suggest Russian-speaking threat actors are behind its development.
Albiriox was first observed in a closed beta phase in September 2025 and became publicly available as a MaaS offering in October 2025, with a subscription model starting at $650 per month. The malware is rapidly evolving, with early campaigns operated by high-reputation affiliates and a structured approach to development and distribution. Security researchers have highlighted the malware's potential for widespread adoption among cybercriminals seeking scalable tools for mobile fraud, given its advanced capabilities and broad targeting of financial applications. The threat is considered significant due to its ability to bypass mobile security solutions and facilitate large-scale, real-time fraudulent activities on compromised devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Cleafy researchers publicly documented Albiriox's capabilities, including unencrypted TCP command-and-control, dual VNC modes, accessibility-based screen capture that can bypass FLAG_SECURE protections, and multiple overlay techniques for credential theft and fraud concealment. Their disclosure also highlighted the malware's hard-coded targeting of 400+ financial apps and its use as a MaaS platform.
Initial observed campaigns, likely run by a single affiliate, targeted Austrian users with German-language SMS phishing lures and fake Google Play-style pages. The infection chain used a fake 'Penny Market' app as a dropper and later evolved to a WhatsApp-based flow that collected phone numbers and exfiltrated data via a Telegram bot.
After its beta phase, Albiriox began being advertised publicly in October 2025 as a malware-as-a-service offering. Its operators promoted capabilities including VNC-based remote access, overlays, and targeting of more than 400 banking, fintech, payment, trading, and cryptocurrency apps.
Researchers reported that the Android malware-as-a-service Albiriox was first observed in a closed beta on Russian-speaking cybercrime forums. The malware was designed to enable on-device fraud through remote control, accessibility abuse, and credential theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcemalwarebytes.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Albiriox** (also referenced as **ALBIRIOX**), an Android remote access trojan sold as **malware-as-a-service** that targets financial institutions, payment services, crypto exchanges, wallets, and trading platforms. The malware is delivered through a fake **"Penny"** dropper app that tricks victims with a fraudulent **System Update** prompt into enabling sideloading, then installs the final payload using **JSONPacker** obfuscation and dynamic unpacking. Once active, Albiriox establishes persistent command-and-control over an unencrypted TCP socket with JSON-based messaging, registers device identifiers, and maintains access through heartbeat traffic while supporting anti-removal persistence. Albiriox enables **on-device fraud** through live screen streaming, full remote control, keylogging, notification interception, and phishing overlays, including targeted overlays for banking and crypto apps as well as black-screen and fake-update screens to hide attacker activity. Its operators use both standard VNC and an Accessibility-based **"AC VNC"** mode designed to bypass Android `FLAG_SECURE` protections, allowing them to steal credentials, OTPs, and session data after MFA and SSO have already been satisfied on the device. Researchers said the malware hardcodes more than **400 target apps** and warned that infected employee phones in **BYOD** environments could expose enterprise SaaS sessions and corporate data; reported indicators include package name `com.nmz.nmz` and C2 address `194.32.79.94:5555`.
Jul 29, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Two newly reported Android **Remote Access Trojans (RATs)**—**SURXRAT** and **Oblivion**—highlight a continued shift toward *commercialized, subscription-based mobile malware* that enables non-expert criminals to gain full control of victim devices and exfiltrate data. Both threats are positioned as scalable offerings (i.e., **Malware-as-a-Service**) with structured sales models and distribution support, lowering the barrier to entry for surveillance, credential theft, and account takeover. The reported infection chains rely heavily on **social engineering** to trick users into installing or activating malicious components, then escalating control by abusing **Android Accessibility Services** to bypass normal interaction and security boundaries. SURXRAT is described as modular and stealth-focused, distributed primarily via **Telegram** channels with tiered licensing/reseller options, and capable of broad data access (e.g., SMS, contacts, location, storage) once high-risk permissions are granted. Oblivion is marketed at roughly **$300/month** (with longer-term pricing tiers) and is delivered via **fake Google Play update** prompts; researchers reported capabilities including SMS theft for banking codes, keylogging, remote unlocking after reboot, and covert live screen viewing while a decoy “system updating” animation distracts the victim, with infrastructure reportedly able to manage **1,000+** concurrent victims (including via Tor).
Jun 29, 2026