Loading story…
Security researchers have identified two new Android malware families, SeedSnatcher and FvncBot, which are actively targeting users in the cryptocurrency and mobile banking sectors. SeedSnatcher employs overlay phishing techniques and BIP 39 validation to steal seed phrases from crypto wallet users, posing a significant threat to the security of digital assets. FvncBot, on the other hand, masquerades as a legitimate security app and targets banking users in Poland, leveraging advanced features such as keylogging, web-inject attacks, and hidden virtual network computing (HVNC) to facilitate financial fraud.
Both malware families exploit Android's accessibility services to gain elevated privileges and evade detection, with FvncBot using a loader app to bypass restrictions on newer Android versions. The campaigns are notable for their use of sophisticated evasion techniques, including crypting services and session-based deployment, and highlight the evolving threat landscape facing both cryptocurrency and banking users on mobile platforms. Security experts recommend heightened vigilance and the use of robust security solutions to mitigate these risks.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A follow-up report highlighted FvncBot as a newly identified Android banking trojan aimed at mBank customers. It emphasized the malware's hidden VNC functionality and H.264-based screen streaming capabilities for remote fraud operations.
A broader research disclosure detailed two Android malware families, FvncBot and SeedSnatcher, alongside an upgraded ClayRat variant. The report said FvncBot targets Polish mBank users with accessibility abuse, keylogging, and screen streaming, while SeedSnatcher steals seed phrases and 2FA codes and ClayRat gained stronger device takeover and concealment features.
Researchers identified the SeedSnatcher Android malware family in the wild targeting cryptocurrency users through overlay-based phishing to steal wallet seed phrases. The malware also validates captured phrases against the BIP-39 standard before using or exfiltrating them, and has been distributed via channels such as Telegram.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified new Android malware campaigns targeting users in India, with a focus on financial fraud and surveillance. The NexusRoute remote access trojan (RAT) was discovered impersonating the Indian e-Challan app and leveraging GitHub for distribution, enabling attackers to conduct UPI fraud and monitor victims' activities. In a separate but related campaign, the FvncBot Android banking trojan masquerades as a legitimate banking-security application, exploiting accessibility and VNC features to capture keystrokes, stream device screens, and inject fraudulent transactions directly from compromised devices. Both malware strains are notable for their ability to operate within genuine banking apps, allowing them to bypass traditional security checks and evade detection. These campaigns highlight the increasing sophistication of mobile threats in India, particularly those targeting financial transactions and personal data. Security experts recommend minimizing app permissions, sourcing apps only from trusted platforms, and implementing real-time behavioral monitoring to mitigate the risks posed by such advanced mobile malware.
Jun 29, 2026
A new wave of Android malware is leveraging sophisticated techniques to evade detection and compromise user devices. The Cellik malware-as-a-service (MaaS) platform enables cybercriminals to create trojanized versions of legitimate Google Play Store apps, embedding malicious payloads while preserving the original app's interface and functionality. This approach allows attackers to bypass security controls such as Play Protect and remain undetected for extended periods. Cellik offers features including real-time screen streaming, notification interception, filesystem browsing, data exfiltration, and a hidden browser mode for session hijacking, all managed through an encrypted command-and-control channel. In parallel, other Android malware campaigns such as NexusRoute and FvncBot are targeting users by impersonating trusted government and banking applications. NexusRoute focuses on Indian citizens by distributing fake mParivahan and e-Challan apps through phishing sites and GitHub repositories, enabling credential theft, device surveillance, and unauthorized financial transactions. FvncBot, meanwhile, disguises itself as a banking-security app and exploits accessibility and VNC features to capture keystrokes, stream screens, and inject fraudulent transactions within genuine banking apps. These developments highlight the increasing sophistication and commercial availability of Android malware, posing significant risks to mobile users and financial institutions alike.
Jun 29, 2026
Multiple new Android malware campaigns have been identified targeting users' financial data and payment methods. Researchers uncovered advanced banking trojans such as BankBot-YNRK and DeliveryRAT, which harvest sensitive information from compromised devices and employ sophisticated evasion techniques, including emulator detection and device-specific targeting. These trojans often masquerade as legitimate apps, such as Indonesia's digital ID application, and can mute device notifications to avoid detection by victims. In addition, a next-generation Android banking trojan has been observed hiding within digital ID apps, automating the theft of cryptocurrency wallets and evading analysis environments. A separate large-scale scam involves over 760 malicious Android apps exploiting NFC and HCE technologies to steal payment card data globally. These apps facilitate unauthorized transactions by leveraging contactless payment features. The surge in Android-targeted financial malware highlights the growing risk to users' banking credentials, payment cards, and cryptocurrency assets, with attackers employing increasingly sophisticated methods to bypass security controls and evade user awareness.
Jun 29, 2026