Loading story…
Kaspersky reported that operators behind the Mamont Android banking Trojan used a new social-engineering scheme in late 2024 to infect users in Russia by posing as sellers of bulk-priced goods. Victims were lured through Telegram chats and phishing sites, reassured by offers such as payment on delivery, and then sent a supposed parcel-tracking application that actually installed malware. Kaspersky said it blocked more than 31,000 attack attempts in October and November 2024.
After installation, the fake app requested broad permissions and transmitted device information and a tracking number to its command-and-control server. Researchers said Mamont could intercept notifications and SMS-related activity and receive remote commands to send SMS messages, issue USSD requests, harvest credentials, and display social-engineering prompts, giving attackers multiple ways to steal financial data and abuse infected devices.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
During October and November 2024, Kaspersky telemetry recorded more than 31,000 blocked attacks linked to the Mamont campaign. The activity reflected significant targeting of Android users in Russia through the parcel-tracking lure.
In late October 2024, Kaspersky documented a new distribution scheme for the Android banking Trojan Mamont in which scammers advertised bulk-priced goods and then sent victims a fake parcel-tracking app that installed malware. The campaign used Telegram chats and phishing sites to build trust and targeted Android users in Russia.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ThreatFabric researchers reported a new Android malware strain, **Manic**, that is being actively distributed in the wild and primarily targets users in Ukraine while also reaching victims across Europe and beyond. The malware combines mobile banking trojan behavior with spyware and remote-control functions, targeting at least **169 applications** tied to banks, government and eID services, payment platforms, cryptocurrency wallets, messaging tools, authenticator apps, and military-focused communications. Reported targets include Ukrainian banks and state services, as well as Russian and European financial institutions and global fintech and crypto services. Manic abuses Android **Accessibility** services and uses transparent keypad overlays to capture credentials and user input while legitimate apps continue to operate, enabling theft of PINs, passwords, SMS codes, and other sensitive data. Researchers said the malware also features an unusual fallback exfiltration method that sends encrypted stolen data through nearby infected devices over **Wi-Fi Direct** or **Bluetooth**, including multi-hop routing when a device lacks direct internet access. The campaign has reportedly been active since at least February, with wrapper-based payload delivery observed in late May and more advanced anti-analysis and in-memory DEX loading added in July.
Aug 21, 2026
Researchers reported that **BTMob** is operating as an Android banking malware and fraud-as-a-service platform that lets multiple criminal actors create branded malicious apps and run large-scale device-takeover campaigns. Analysis of leaked source packages and exposed infrastructure linked the operation to roughly **1,400 live servers**, including command-and-control nodes, an automated APK-building ecosystem, and backend components used to manage victim infections and operator access. The platform is being spread through fake apps, cloned download pages, and social-engineering lures, including WhatsApp messages and phone calls in Brazil that pressure victims to sideload APKs and grant dangerous permissions. Investigators tied the activity to infrastructure using `/yaarsa/` PHP backend paths, HTTP and WebSocket endpoints, a control panel on port `3000` identified by the string **"painel de controle elite"**, and payloads including `lnat-tv-pro.apk`, `BTMob.exe`, `SolrStarter.exe`, and `SolrWorker.exe`, while also linking the operation to the earlier **CraxsRAT** and **SpySolr** malware families.
Aug 22, 2026
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026