Loading story…
Researchers reported that the GodFather Android malware is being delivered through a multistage dropper that hides its payload with ZIP header tampering, fake encryption flags, string obfuscation, dead code, and dynamic DEX loading. In the analyzed sample (SHA-256: 49002e994539fa11eab6b7a273cf90272dda43aa3dd9784fde4c23bf3645fdcb), the app com.metaprescutal.systematist extracts an embedded asset containing two encrypted DEX files, decrypts them with a hardcoded DES key, and displays a Turkish-language lure to persuade victims to allow installation of unknown apps. It then side-loads umbras.apk as package com.heb.reb using the Android PackageInstaller session API and launches the installed GodFather core component.
The campaign shows how mobile malware operators are combining layered droppers with virtualization-style abuse and Android permission workarounds to defeat platform protections and increase fraud potential. By installing the payload through session-based mechanisms, the malware is designed to bypass Android 13 Restricted Settings barriers that normally hinder side-loaded apps from gaining sensitive access; once active, the GodFather core seeks Accessibility Service privileges to enable spyware and banking trojan behavior. The broader research warns that this tradecraft turns legitimate mobile app environments into an attacker-controlled execution space, complicating detection for defenders and raising the risk of credential theft and on-device account takeover.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Shindan's analysis states that the more sophisticated GodFather dropper variant it examined was first identified by Zimperium in June. The variant uses a multistage dropper approach designed to bypass Android 13 security restrictions during payload installation.
Shindan published a detailed reverse-engineering report on an Android sample with package name com.metaprescutal.systematist and SHA-256 49002e994539fa11eab6b7a273cf90272dda43aa3dd9784fde4c23bf3645fdcb. The report documented ZIP tampering, staged DEX decryption, and session-based installation of the GodFather payload as com.heb.reb.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Godfather** Android banking trojan has been documented as an active mobile threat that steals financial, identity, and personal data from Android users through extensive device surveillance and account-takeover features. Technical reporting describes the malware abusing Android accessibility services for keylogging and screen interaction monitoring, while also stealing SMS messages and notifications to intercept authentication flows and bypass **2FA**. Researchers said the malware also supports **VNC-style remote control**, proxying, and command-and-control communications, giving operators broad visibility into infected devices and the ability to manipulate sessions tied to banking and other sensitive apps. Analysis of the malware shows Godfather relying on runtime string decryption with **Blowfish**, dynamically retrieving targeted application lists from its C2 infrastructure, and obtaining C2 details from a **Telegram account description** to complicate tracking and takedown efforts. Reporting cited prior observations that the trojan targeted more than **400 financial organizations** between 2021 and 2022, with renewed campaigns focusing heavily on **Turkey** and using fake music applications as an infection vector. Reverse-engineering materials and public research repositories have since published notes, slides, code, and marked-up samples to help defenders better understand the malware's behavior and detection opportunities.
Aug 15, 2026
Group-IB reported on the **Godfather** Android banking trojan, a malware strain designed to compromise mobile banking users by stealing credentials and other sensitive financial data from infected devices. The trojan is associated with attacks against banking and cryptocurrency applications, using Android-focused infection and evasion techniques to gain access to victims’ accounts and facilitate fraud. The report highlights Godfather as part of the continuing threat posed by mobile banking malware, with operators adapting their tooling to target financial apps and harvest authentication data at scale. The activity underscores the risk to organizations and consumers relying on Android devices for financial services, particularly where malware can abuse accessibility features, overlay attacks, or other device permissions to intercept user input and bypass normal security controls.
Jul 12, 2026
Security researchers reported multiple Android malware campaigns that used droppers distributed through **Google Play** to install banking trojans and remote-access malware while evading marketplace defenses. Check Point detailed **Clast82**, a dropper embedded in trojanized utility apps that delayed malicious activity until after publication by checking a Firebase-controlled `enable` flag, then fetched payloads from GitHub and pushed victims to allow installs from unknown sources through repeated fake **Google Play Services** prompts. The campaign delivered **AlienBot Banker** and **MRAT**, relied on fake developer accounts and shared infrastructure, and led to the removal of the identified apps from Google Play. Trend Micro later described **DawDropper** as a similar Android dropper operation that also abused **Firebase Realtime Database** and **GitHub** to dynamically retrieve payloads and avoid detection in apps posing as document scanners, cleaners, and QR scanners. DawDropper was used to distribute banking malware including **Octo**, **Hydra**, **Ermac**, and **TeaBot**; researchers said Octo could steal banking credentials, intercept SMS messages, disable **Google Play Protect**, hijack devices, and use **VNC-based** remote screen control while hiding its activity. The findings also tied these campaigns to a broader underground market for **dropper-as-a-service (DaaS)** offerings, showing how commodity delivery infrastructure was being used to scale Android banking malware distribution.
Aug 14, 2026