Loading story…
Researchers reported that Ghimob, an Android banking trojan linked to Brazil’s Guildma operation and the broader Tétrade malware family, was built to steal from users of financial and cryptocurrency apps by letting operators control transactions directly on infected phones. The malware is delivered through malicious links that serve either Windows ZIP archives or Android APKs based on the visitor’s user agent, tying the mobile activity to infrastructure also used in Guildma’s Windows campaigns. Although early observed victims were in Brazil, the malware was configured to target institutions in multiple countries, including Paraguay, Peru, Portugal, Germany, Angola, and Mozambique.
Ghimob abuses Android Accessibility services to gain persistence and remote-control capabilities, then hides its icon and interferes with uninstallation and shutdown attempts to stay on the device. Its command-and-control design also reflects the fallback channel pattern tracked as MITRE ATT&CK T1008, using redundant methods to recover real C2 servers through Cloudflare-protected infrastructure and DGA-like techniques when primary paths are unavailable. The combination of anti-analysis checks, resilient C2, and on-device fraud execution makes Ghimob a capable mobile banking threat with clear potential for international expansion.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
At the time of observation, telemetry indicated that observed Ghimob victims were located in Brazil. The malware was also configured to target financial and cryptocurrency apps across multiple other countries, suggesting potential international expansion.
The campaign used creditor-themed emails containing malicious links that delivered either a Windows ZIP archive or an Android APK depending on the visitor's user-agent. The APKs were hosted on malicious domains registered by Guildma operators and masqueraded as apps such as Google Defender, Google Docs, and WhatsApp Updater.
Kaspersky researchers found the Ghimob Android banking trojan while monitoring a Windows malware campaign associated with the Brazilian Guildma threat actor. The discovery linked the mobile malware to Guildma and the broader Tétrade banking trojan ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Gustuff** Android banking trojan evolved from an earlier malware family into a more capable fraud platform that spreads mainly through SMS links to malicious APKs and social-media-themed lures. Initially marketed on Russian-speaking criminal forums as an updated version of AndyBot, Gustuff was offered for lease and aimed largely at victims outside Russia. The malware was observed targeting users in Australia and other countries including the United States, Poland, Germany, and India, with victim lists spanning more than 100 banking apps, dozens of cryptocurrency services, fintech platforms, marketplaces, payment systems, messengers, hiring apps, and the Australian Government Portal. The updated malware relies heavily on Android **Accessibility Service** to automate on-device fraud, including interacting with legitimate apps, displaying fake push notifications and overlays, and using an Automatic Transfer System to fill transaction fields. Researchers said newer versions reduced static indicators by loading target app lists dynamically from command-and-control servers and added JavaScript-based scripting, asynchronous task handling, improved command tracking, and an interactive mode for automated actions on infected devices. Gustuff also retained broad device-control features, including reading and sending SMS messages, issuing USSD requests, exfiltrating files and device data, launching a SOCKS5 proxy, disabling Google Protect in many cases, resetting devices, and maintaining resilience through an SMS-based secondary administrative channel when primary C2 infrastructure was disrupted.
Aug 15, 2026
The Android banking trojan **TgToxic** has evolved from a Southeast Asia-focused malware operation into a broader campaign targeting victims in Europe and Latin America, while continuing to steal banking credentials, cryptocurrency, and funds. Earlier reporting tied TgToxic to phishing and scam-themed lures delivered through malicious websites and messaging apps such as WhatsApp and Viber, where victims were pushed to install fake Android apps and grant dangerous permissions that enabled attackers to take automated control of infected devices. Recent analysis found the operators significantly upgraded the malware’s resilience and evasion. A second variant observed in late 2024 hid encrypted command-and-control data behind dead-drop resolvers on 25 community forums, and a third variant shifted to a **domain generation algorithm (DGA)** to make disruption harder. Newer samples also introduced stronger anti-emulation and anti-analysis checks, including hardware fingerprinting, Android feature validation, and emulator artifact detection, reinforcing assessments that the operators are actively adapting the trojan in response to public reporting and defensive scrutiny.
Aug 15, 2026
The **Godfather** Android banking trojan has been documented as an active mobile threat that steals financial, identity, and personal data from Android users through extensive device surveillance and account-takeover features. Technical reporting describes the malware abusing Android accessibility services for keylogging and screen interaction monitoring, while also stealing SMS messages and notifications to intercept authentication flows and bypass **2FA**. Researchers said the malware also supports **VNC-style remote control**, proxying, and command-and-control communications, giving operators broad visibility into infected devices and the ability to manipulate sessions tied to banking and other sensitive apps. Analysis of the malware shows Godfather relying on runtime string decryption with **Blowfish**, dynamically retrieving targeted application lists from its C2 infrastructure, and obtaining C2 details from a **Telegram account description** to complicate tracking and takedown efforts. Reporting cited prior observations that the trojan targeted more than **400 financial organizations** between 2021 and 2022, with renewed campaigns focusing heavily on **Turkey** and using fake music applications as an infection vector. Reverse-engineering materials and public research repositories have since published notes, slides, code, and marked-up samples to help defenders better understand the malware's behavior and detection opportunities.
Aug 15, 2026