Loading story…
Researchers reported that monetized URL shortener services and fake download pages were used to push Android/FakeAdBlocker and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as adBLOCK app.apk, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than 150,000 Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs.
The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including Cerberus, Ginp, and TeaBot, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread TeaBot and FluBot, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
ESET published detailed research describing how monetized URL shortener services were used to distribute Android/FakeAdBlocker, adware, banking trojans, SMS trojans, and iOS calendar-subscription scams. The report also documented the malware's payload delivery, regional targeting, and abuse of Google Calendar for scareware.
ESET said it detected more than 150,000 downloads of Android/FakeAdBlocker to Android devices between the beginning of 2021 and July 1, 2021. The figure indicates substantial campaign scale during that period.
Bitdefender Labs identified TeaBot, also known as Anatsa, as another banking trojan delivered by Android/FakeAdBlocker. This added another banking malware family to the list of observed payloads.
ThreatFabric published research on Ginp, another Android banking trojan. ESET later identified Ginp as one of the payloads distributed through the Android/FakeAdBlocker campaign.
ESET reported that the Android/FakeAdBlocker malware family was first spotted in September 2019. The campaign used monetized URL shortener services and deceptive download flows to target mobile users.
ThreatFabric published research on Cerberus as a new Android banking trojan. This establishes Cerberus as an existing malware payload later delivered by Android/FakeAdBlocker.
4 references tracked. Mallory keeps watching after this page renders.
labs.bitdefender.com
Open sourcewelivesecurity.com
Open sourcethreatfabric.com
Open sourcethreatfabric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors used **COVID-19-themed lures** to push Android malware through SMS phishing and unofficial download sites, targeting users with fake alerts, safety tools, and public-health claims. Proofpoint reported that the **TangleBot** campaign sent text messages in the United States and Canada themed around coronavirus information and power outages, directing Android users to links that served a malicious APK and a fake **Adobe Flash Player** update prompt. Separately, researchers documented a fake **"Corona Safety Mask"** app and similar coronavirus-themed Android packages that were distributed outside official app stores and promoted through deceptive websites and messages. Once installed, the malware gave operators extensive access to infected devices. TangleBot supported surveillance and device control features including **keylogging, SMS and call control, screen capture, camera and microphone access, GPS tracking, clipboard access, and overlay injection**, while using obfuscation and Telegram-based command-and-control discovery to hinder analysis. The other Android trojan focused on propagation by requesting permission to read contacts and send SMS messages, harvesting address books and sending malicious texts with download links to additional victims; researchers also warned the app appeared capable of evolving toward broader fraud or theft functions.
Aug 15, 2026
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026