Loading story…
Zimperium’s zLabs has identified a new Android banking trojan, Rokarolla, that targets 217 banking and cryptocurrency applications and gives attackers broad control over infected devices through 137 remote commands. The malware is distributed via malicious websites impersonating popular apps such as TikTok and Chrome, then installs a secondary dropper disguised as Google Play Protect to obtain Accessibility permissions and deploy the payload. Researchers said Rokarolla steals credentials with fake overlays and phishing pages placed over legitimate financial apps and even the device lock screen, enabling theft of usernames, passwords, PINs, and SMS one-time codes.
Beyond financial theft, Rokarolla supports deep surveillance and device manipulation, including keylogging, screenshot and screen-log capture, contact and notification scraping, WhatsApp data theft, call suppression, sound muting, clipboard hijacking to reroute cryptocurrency transfers, and disabling Google Play Protect scans. Zimperium said the malware also uses multiple fallback command-and-control domains and a Pseudo-VNC capability to maintain resilient access and monitor victims in near real time, underscoring how Android banking trojans are evolving from credential theft into full device takeover that can bypass multi-factor authentication protections.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Zimperium’s zLabs researchers documented a new Android banking trojan named Rokarolla. The malware targets 217 banking and cryptocurrency applications, uses a fake Google Play Protect dropper and Accessibility abuse, and supports extensive fraud and surveillance capabilities including 137 remote commands.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
12 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.polyswarm.io
Open sourcesecurityweek.com
Open sourcesecurityaffairs.com
Open sourcegovinfosecurity.com
Open sourcebleepingcomputer.com
Open sourcebankinfosecurity.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Rokarolla** Android banking trojan has evolved from credential theft into near-complete device takeover, targeting **217 banking and cryptocurrency apps**. The malware is distributed through malicious websites impersonating **TikTok** or **Google Chrome** and through a dropper masquerading as **Google Play Protect**, then abuses Android **Accessibility Services** to capture credentials, intercept SMS one-time passcodes, and display fake overlay login screens over legitimate financial apps. Once installed, Rokarolla can isolate victims from their banks by blocking calls, suppressing alerts, hiding its icon, and attempting to disable **Google Play Protect**. Researchers said it supports **137 commands** and adds surveillance and fraud features including timestamped screenshot capture for exfiltration and clipboard hijacking that replaces copied cryptocurrency wallet addresses with attacker-controlled ones, significantly expanding the malware’s ability to steal funds and maintain persistence on infected devices.
Aug 11, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
The **BlackRock** Android banking trojan was distributed through a fake Clubhouse website that mimicked the legitimate service and lured users seeking an Android version of the app. Instead of sending victims to Google Play, the site delivered a malicious APK from an insecure `.mobi` domain over HTTP. Once installed, the malware sought **Accessibility Service** permissions, hid its icon, contacted a command-and-control server, and used overlay attacks to steal usernames, passwords, and payment card data. Researchers linked BlackRock to the **Xerxes** malware, a descendant of the **LokiBot** family, and found that it had expanded far beyond traditional banking targets. The trojan was reported targeting **337 apps** in one analysis and **458 apps** in a later campaign, spanning banking, cryptocurrency, shopping, email, social media, communication, and dating services. It also supported **SMS theft**, notification theft, keylogging, anti-removal behavior, and abuse of Android work profiles to gain elevated privileges, allowing attackers to bypass or weaken SMS-based two-factor authentication and broaden credential theft across consumer and enterprise use cases.
Aug 15, 2026