Loading story…
Researchers and Italy’s CERT-AGID reported that the Android banking trojan Oscorp, later tracked as UBEL, was distributed through a malicious APK site in Italy and evolved into a broader global campaign targeting more than 150 applications, including banking apps. The malware abused Android’s Accessibility Service to gain extensive control over infected devices, repeatedly coercing victims to grant accessibility, usage statistics, battery optimization exemptions, and sometimes device administrator privileges to maintain persistence and expand access.
Once active, UBEL/Oscorp could steal credentials through phishing overlays rendered in a WebView, intercept SMS messages, place calls, trigger call forwarding, execute USSD requests, launch or remove apps, and block legitimate applications. Analysts also documented screen and audio capture via WebRTC/STUN, HTTP POST communications with command-and-control servers, and specialized theft functions including replacement of cryptocurrency wallet addresses and harvesting of Google Authenticator one-time codes; published indicators included malware hashes, package names, C2 domains, injection paths, and AES keys tied to the operation.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Cleafy Labs reported that Oscorp had evolved into Oscorp/Ubel and documented its expanded capabilities and infrastructure. The analysis said the malware targeted more than 150 applications across multiple geographies and published associated hashes, package names, C2 domains, injection paths, and AES keys.
CERT-AGID published an analysis of the Android malware family it named Oscorp, describing its abuse of Accessibility Service, phishing overlays, SMS interception, call functions, device data theft, WebRTC-based audio/screen capture, cryptocurrency address replacement, and theft of Google Authenticator codes. The report also documented its package name, permissions, AES string encryption, C2 endpoints, and supported command set.
CERT-AGID reported that it had identified a website distributing a malicious Android APK in Italy. The reference indicates this as an early public notice tied to the malware activity later analyzed as Oscorp.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
developer.android.com
Open sourcecleafy.com
Open sourcecert-agid.gov.it
Open sourcecert-agid.gov.it
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the Android banking trojan **Aberebot** evolved into a new variant called **Escobar**, a malicious app disguised as trusted software such as Google Chrome and McAfee. The malware targets customers of more than **140 banks and financial institutions across 18 countries**, while also phishing for credentials tied to services including **PayPal**, **Gmail**, **MobiKwik**, and **Unocoin**. Earlier Aberebot samples used phishing pages hosted from a GitHub repository and relied on **Telegram** bot infrastructure for command-and-control and data exfiltration. Escobar significantly expands the original malware's capabilities beyond banking theft by abusing Android accessibility and other dangerous permissions to steal **Google Authenticator** codes, intercept **SMS** and OTPs, monitor notifications, harvest contacts, call logs, files, and location data, and remotely control infected devices through **VNC**. The malware can also record audio, take photos, send SMS messages, inject web pages, uninstall apps, delete itself, and enumerate device and network information consistent with mobile discovery behavior such as **MITRE ATT&CK `T1421`**. Researchers said the malware was heavily obfuscated, actively developed, and advertised on a cybercrime forum, indicating continued investment by its operators.
Aug 15, 2026
Researchers documented multiple evolutions of the **BianLian** Android banking trojan, showing a malware family that abuses **Accessibility Services** to seize control of infected devices, hide its launcher icon, deploy overlay attacks, intercept SMS, execute USSD commands, lock screens, and target banking and cryptocurrency users. Fortinet reported a heavily obfuscated variant that dynamically loads a secondary APK downloaded from command-and-control infrastructure rather than decrypting it from app assets, and noted that the payload checks whether **Google Play Protect** is enabled through the **SafetyNet API**. Later analysis of a newer sample found BianLian continuing to broaden both its infrastructure and victim scope, using a **Tor onion service** to deliver a Base64-encoded JSON configuration containing multiple C2 domains and targeting **438 mobile applications**, primarily banking apps. The malware also added or refined remote-access capabilities including **screen recording** via `MediaProjection` and a **SOCKS5/SSH proxy** with remote port forwarding, while reorganizing code to improve persistence and evasion on major Android vendors by handling battery optimizations, disabling Huawei and Samsung protections, and enabling autostart on Xiaomi MIUI devices.
Aug 15, 2026
Researchers identified **OverlayPhantom**, a previously undocumented Android banking trojan distributed through malicious URLs that impersonate trusted apps including Austria’s **ID Austria** and **TikTok**. The malware uses a two-stage infection chain: a dropper installs a payload disguised as **Google Play Services**, then abuses Android **Accessibility Service** to gain persistent control of the device. Investigators said the campaign has been active since early May 2025 and is aimed at large-scale financial fraud across Western markets. OverlayPhantom targets more than **180 banking, financial, and cryptocurrency applications** across **10 countries**, using embedded HTML overlay phishing pages to steal credentials and payment data. The malware also leverages Android’s **MediaProjection API** for near-real-time JPEG screen streaming and supports more than **30 remote commands**, including gesture simulation, clipboard manipulation, fake notifications, device locking, and PIN or password capture. Its command-and-control infrastructure was tied to `199.217[.]99[.]122`, using non-standard ports `9091`, `9092`, and `9090` for command execution, device reporting, and screen streaming.
Jun 29, 2026