Loading story…
Researchers reported that the Rokarolla Android banking trojan has evolved from credential theft into near-complete device takeover, targeting 217 banking and cryptocurrency apps. The malware is distributed through malicious websites impersonating TikTok or Google Chrome and through a dropper masquerading as Google Play Protect, then abuses Android Accessibility Services to capture credentials, intercept SMS one-time passcodes, and display fake overlay login screens over legitimate financial apps.
Once installed, Rokarolla can isolate victims from their banks by blocking calls, suppressing alerts, hiding its icon, and attempting to disable Google Play Protect. Researchers said it supports 137 commands and adds surveillance and fraud features including timestamped screenshot capture for exfiltration and clipboard hijacking that replaces copied cryptocurrency wallet addresses with attacker-controlled ones, significantly expanding the malware’s ability to steal funds and maintain persistence on infected devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Zimperium's zLabs disclosed a newly discovered Android banking trojan named Rokarolla, describing a campaign that targets 217 banking and cryptocurrency apps and uses 137 commands. The research said the malware spreads via malicious sites impersonating TikTok or Google Chrome and a dropper posing as Google Play Protect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimperium’s zLabs has identified a new Android banking trojan, **Rokarolla**, that targets **217 banking and cryptocurrency applications** and gives attackers broad control over infected devices through **137 remote commands**. The malware is distributed via malicious websites impersonating popular apps such as TikTok and Chrome, then installs a secondary dropper disguised as **Google Play Protect** to obtain Accessibility permissions and deploy the payload. Researchers said Rokarolla steals credentials with fake overlays and phishing pages placed over legitimate financial apps and even the device lock screen, enabling theft of usernames, passwords, PINs, and SMS one-time codes. Beyond financial theft, Rokarolla supports deep surveillance and device manipulation, including keylogging, screenshot and screen-log capture, contact and notification scraping, WhatsApp data theft, call suppression, sound muting, clipboard hijacking to reroute cryptocurrency transfers, and disabling Google Play Protect scans. Zimperium said the malware also uses multiple fallback command-and-control domains and a **Pseudo-VNC** capability to maintain resilient access and monitor victims in near real time, underscoring how Android banking trojans are evolving from credential theft into full device takeover that can bypass multi-factor authentication protections.
Jul 12, 2026
The **BlackRock** Android banking trojan was distributed through a fake Clubhouse website that mimicked the legitimate service and lured users seeking an Android version of the app. Instead of sending victims to Google Play, the site delivered a malicious APK from an insecure `.mobi` domain over HTTP. Once installed, the malware sought **Accessibility Service** permissions, hid its icon, contacted a command-and-control server, and used overlay attacks to steal usernames, passwords, and payment card data. Researchers linked BlackRock to the **Xerxes** malware, a descendant of the **LokiBot** family, and found that it had expanded far beyond traditional banking targets. The trojan was reported targeting **337 apps** in one analysis and **458 apps** in a later campaign, spanning banking, cryptocurrency, shopping, email, social media, communication, and dating services. It also supported **SMS theft**, notification theft, keylogging, anti-removal behavior, and abuse of Android work profiles to gain elevated privileges, allowing attackers to bypass or weaken SMS-based two-factor authentication and broaden credential theft across consumer and enterprise use cases.
Aug 15, 2026
Researchers identified **OverlayPhantom**, a previously undocumented Android banking trojan distributed through malicious URLs that impersonate trusted apps including Austria’s **ID Austria** and **TikTok**. The malware uses a two-stage infection chain: a dropper installs a payload disguised as **Google Play Services**, then abuses Android **Accessibility Service** to gain persistent control of the device. Investigators said the campaign has been active since early May 2025 and is aimed at large-scale financial fraud across Western markets. OverlayPhantom targets more than **180 banking, financial, and cryptocurrency applications** across **10 countries**, using embedded HTML overlay phishing pages to steal credentials and payment data. The malware also leverages Android’s **MediaProjection API** for near-real-time JPEG screen streaming and supports more than **30 remote commands**, including gesture simulation, clipboard manipulation, fake notifications, device locking, and PIN or password capture. Its command-and-control infrastructure was tied to `199.217[.]99[.]122`, using non-standard ports `9091`, `9092`, and `9090` for command execution, device reporting, and screen streaming.
Jun 29, 2026