UBEL/Oscorp Android Banking Trojan Abused Accessibility for Global Overlay Attacks

Researchers and Italy’s CERT-AGID reported that the Android banking trojan Oscorp, later tracked as UBEL, was distributed through a malicious APK site in Italy and evolved into a broader global campaign targeting more than 150 applications, including banking apps. The malware abused Android’s Accessibility Service to gain extensive control over infected devices, repeatedly coercing victims to grant accessibility, usage statistics, battery optimization exemptions, and sometimes device administrator privileges to maintain persistence and expand access.

Once active, UBEL/Oscorp could steal credentials through phishing overlays rendered in a WebView, intercept SMS messages, place calls, trigger call forwarding, execute USSD requests, launch or remove apps, and block legitimate applications. Analysts also documented screen and audio capture via WebRTC/STUN, HTTP POST communications with command-and-control servers, and specialized theft functions including replacement of cryptocurrency wallet addresses and harvesting of Google Authenticator one-time codes; published indicators included malware hashes, package names, C2 domains, injection paths, and AES keys tied to the operation.