Loading story…
Researchers detailed Albiriox (also referenced as ALBIRIOX), an Android remote access trojan sold as malware-as-a-service that targets financial institutions, payment services, crypto exchanges, wallets, and trading platforms. The malware is delivered through a fake "Penny" dropper app that tricks victims with a fraudulent System Update prompt into enabling sideloading, then installs the final payload using JSONPacker obfuscation and dynamic unpacking. Once active, Albiriox establishes persistent command-and-control over an unencrypted TCP socket with JSON-based messaging, registers device identifiers, and maintains access through heartbeat traffic while supporting anti-removal persistence.
Albiriox enables on-device fraud through live screen streaming, full remote control, keylogging, notification interception, and phishing overlays, including targeted overlays for banking and crypto apps as well as black-screen and fake-update screens to hide attacker activity. Its operators use both standard VNC and an Accessibility-based "AC VNC" mode designed to bypass Android FLAG_SECURE protections, allowing them to steal credentials, OTPs, and session data after MFA and SSO have already been satisfied on the device. Researchers said the malware hardcodes more than 400 target apps and warned that infected employee phones in BYOD environments could expose enterprise SaaS sessions and corporate data; reported indicators include package name com.nmz.nmz and C2 address 194.32.79.94:5555.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-18, JUMPSEC published an analysis of ALBIRIOX describing it as a MaaS Android RAT used for cryptocurrency theft and financial fraud, with added risk to BYOD environments. The report included operational details, persistence behavior, and indicators such as C2 address 194.32.79.94:5555, package name com.nmz.nmz, and associated hashes.
Cleafy Labs published technical findings on Albiriox, describing an Android banking trojan/RAT that uses a fake "Penny" dropper, VNC-based remote control, overlay attacks, and persistent C2 communications. The report says the malware targets more than 400 banking, fintech, payment, crypto, wallet, and trading applications globally and is commercialized in a MaaS-style model.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new Android malware called **Albiriox** has emerged, offered under a malware-as-a-service (MaaS) model and targeting over 400 financial, banking, fintech, cryptocurrency, and payment applications. The malware is distributed via dropper apps using social engineering lures, such as fake Google Play Store pages, and employs advanced evasion techniques including packing and integration with third-party crypting services. Once installed, Albiriox enables real-time device control, screen manipulation, and on-device fraud, leveraging a VNC-based remote access module and developing overlay systems for credential theft. Initial campaigns have specifically targeted Austrian users with German-language SMS lures, and the malware's infrastructure and forum activity suggest Russian-speaking threat actors are behind its development. Albiriox was first observed in a closed beta phase in September 2025 and became publicly available as a MaaS offering in October 2025, with a subscription model starting at $650 per month. The malware is rapidly evolving, with early campaigns operated by high-reputation affiliates and a structured approach to development and distribution. Security researchers have highlighted the malware's potential for widespread adoption among cybercriminals seeking scalable tools for mobile fraud, given its advanced capabilities and broad targeting of financial applications. The threat is considered significant due to its ability to bypass mobile security solutions and facilitate large-scale, real-time fraudulent activities on compromised devices.
Jun 29, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Group-IB reported that **CraxsRAT** is being used as a central malware platform in fake Android app campaigns tied to banking fraud. The malware is distributed through trojanized applications that impersonate legitimate services, allowing attackers to infect devices and gain extensive remote access. Once installed, CraxsRAT can support surveillance, credential theft, and device manipulation, giving operators the ability to harvest sensitive information from victims’ phones. The activity highlights how mobile malware operators are combining social engineering with remote-access tooling to target financial accounts at scale. By embedding CraxsRAT in fraudulent apps, threat actors can bypass user trust, monitor victim activity, and facilitate unauthorized banking transactions, making the malware a key enabler of broader fake-app scam operations against Android users.
Jul 12, 2026