Loading story…
Researchers reported multiple Google Play Store campaigns distributing the Hydra Android banking trojan through seemingly benign dropper apps. One campaign used a fake "Document Manager" app that drew more than 10,000 downloads and prompted users to install a supposed update, which fetched a second-stage APK from attacker-controlled infrastructure. Earlier analysis of Hydra-linked droppers found similar Play Store distribution between 2018 and 2019, with malware using overlay attacks to steal banking credentials and targeting users in specific regions, including checks for Turkish devices and later activity aligned with campaigns against users in Colombia.
Technical analysis showed Hydra operators separating the downloader from the banking payload to reduce detection. Samples used minimal initial permissions such as REQUEST_INSTALL_PACKAGES, then unpacked additional components through dropped DEX files, including one case where the payload was reconstructed from a PNG asset using steganography-like methods and loaded via the native library libhoter.so. Once installed, Hydra variants were observed stealing SMS messages, cookies, OTPs, and device lock PINs, abusing Accessibility Services to hinder removal, and using command-and-control infrastructure, including TOR-related communications, to manage infections and deliver malicious modules.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Cyble reported that the malicious 'Document Manager' downloader app was released on the Google Play Store on June 3, 2022, where it later amassed more than 10,000 downloads.
Cyble reported that the fake 'Document Manager' app used to deliver Hydra was updated on the Google Play Store on May 30, 2022.
Cyble reported that Hydra campaigns in April targeted Colombia through phishing sites, representing activity before the later Play Store distribution shift.
The Pentest Blog analysis links the sample's native time validation to a date around April 6, 2019, corresponding to the period when the malicious app was on the Play Store.
The same analysis says Hydra dropper apps remained on Google Play Store through March 2019, showing sustained Play Store distribution over that period.
The Pentest Blog analysis states that at least 8 to 10 Hydra samples were distributed through dropper apps on the Google Play Store between July 2018 and March 2019.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple Android malware campaigns that used droppers distributed through **Google Play** to install banking trojans and remote-access malware while evading marketplace defenses. Check Point detailed **Clast82**, a dropper embedded in trojanized utility apps that delayed malicious activity until after publication by checking a Firebase-controlled `enable` flag, then fetched payloads from GitHub and pushed victims to allow installs from unknown sources through repeated fake **Google Play Services** prompts. The campaign delivered **AlienBot Banker** and **MRAT**, relied on fake developer accounts and shared infrastructure, and led to the removal of the identified apps from Google Play. Trend Micro later described **DawDropper** as a similar Android dropper operation that also abused **Firebase Realtime Database** and **GitHub** to dynamically retrieve payloads and avoid detection in apps posing as document scanners, cleaners, and QR scanners. DawDropper was used to distribute banking malware including **Octo**, **Hydra**, **Ermac**, and **TeaBot**; researchers said Octo could steal banking credentials, intercept SMS messages, disable **Google Play Protect**, hijack devices, and use **VNC-based** remote screen control while hiding its activity. The findings also tied these campaigns to a broader underground market for **dropper-as-a-service (DaaS)** offerings, showing how commodity delivery infrastructure was being used to scale Android banking malware distribution.
Aug 14, 2026
**SharkBot**, an Android banking trojan targeting European banks, was found masquerading as legitimate mobile apps and abusing **Accessibility Services** to seize broad device control, steal credentials, intercept or send SMS messages, and launch overlay attacks against banking users. Researchers said the malware hid its icon after installation, maintained command-and-control connectivity by evading battery restrictions, and used encrypted communications, geofencing, sandbox evasion, and an uncommon Android **DGA** capability. Early analysis indicated the malware was likely still being actively developed, with incomplete features, test strings, and signs it may have been built as a private botnet. The malware was later distributed through multiple malicious **Google Play** droppers, including fake antivirus, cleaner, tax-code, and file-manager apps, with researchers linking SharkBot delivery to at least six Play Store apps and estimating tens of thousands of installs across campaigns. One fake Italian tax app alone drew more than **10,000** installs, while broader Android dropper activity tied to SharkBot and other banking malware exceeded **130,000** cumulative installations. The campaigns primarily targeted users in **Italy** and the **UK**, with additional exposure in the Netherlands, Germany, and France, and Google removed identified apps after researcher notification, though SharkBot activity continued to evolve after the takedowns.
Aug 15, 2026
Two Android apps on Google Play, **Currency Converter** and **BatterySaverMobi**, were found distributing the **Anubis** banking trojan through a dropper chain that prompted users to install a fake system update. The malware used motion-sensor checks to evade sandboxes and emulators, pulled command-and-control details from Telegram and Twitter content, and was linked to infrastructure including the domain `aserogeege.space` and IP address `47.254.26.2`. Once installed, Anubis targeted banking users across **93 countries** and **377 financial app variants**, stealing credentials through keylogging and screenshots while also abusing accessibility services to access contacts, location, audio, SMS, calls, and storage. Technical analysis showed the Anubis payload was heavily protected with reflection, obfuscation, runtime class loading, and encrypted `.dex` files, complicating static inspection. Researchers demonstrated that dynamic instrumentation with **Frida** could trace reflection calls, intercept file deletion, and preserve decrypted payloads dropped at runtime, while alternative methods recovered `.dex` remnants from memory or extracted the RC4 key and C2 configuration directly from the APK. Google removed the malicious apps from the Play Store after the abuse was confirmed, but the case highlighted how mobile banking malware can combine trusted distribution channels, anti-analysis tricks, and layered packing to hinder detection and reverse engineering.
Aug 15, 2026