Loading story…
SharkBot, an Android banking trojan targeting European banks, was found masquerading as legitimate mobile apps and abusing Accessibility Services to seize broad device control, steal credentials, intercept or send SMS messages, and launch overlay attacks against banking users. Researchers said the malware hid its icon after installation, maintained command-and-control connectivity by evading battery restrictions, and used encrypted communications, geofencing, sandbox evasion, and an uncommon Android DGA capability. Early analysis indicated the malware was likely still being actively developed, with incomplete features, test strings, and signs it may have been built as a private botnet.
The malware was later distributed through multiple malicious Google Play droppers, including fake antivirus, cleaner, tax-code, and file-manager apps, with researchers linking SharkBot delivery to at least six Play Store apps and estimating tens of thousands of installs across campaigns. One fake Italian tax app alone drew more than 10,000 installs, while broader Android dropper activity tied to SharkBot and other banking malware exceeded 130,000 cumulative installations. The campaigns primarily targeted users in Italy and the UK, with additional exposure in the Netherlands, Germany, and France, and Google removed identified apps after researcher notification, though SharkBot activity continued to evolve after the takedowns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
ThreatFabric discovered three new Brunhilda-linked Google Play droppers, with installation counts ranging from 1,000 to 100,000, that posed as authenticator or file-recovery apps and delivered a new Vultur variant.
ThreatFabric identified a second SharkBot dropper on Google Play disguised as a file manager, configured for Italy and the UK, and noted it was quickly removed after discovery.
In early October 2022, ThreatFabric observed a SharkBot campaign targeting Italian banking users through a fake Google Play app named "Codice Fiscale 2022," with SharkBot versions 2.29 through 2.32.
Fox-IT reported a new SharkBot Google Play campaign distributing fake antivirus and cleaner apps that dropped SharkBot v2 payloads, replacing the earlier Accessibility-based auto-install flow with a fake app-update prompt to evade review. The campaign initially targeted the UK and Italy, and Fox-IT later observed infrastructure expanding targeting to Spain, Australia, Poland, Germany, the United States, and Austria.
The additional SharkBot dropper applications discovered later in March were removed from Google Play.
The initially reported SharkBot dropper applications were removed from Google Play after Check Point reported them to Google.
Check Point reported that SharkBot activity peaked in early March 2022, with observed targeting concentrated mainly in Italy and the United Kingdom.
Check Point Research found additional SharkBot dropper applications on Google Play on March 15 and March 22, expanding the known set of malicious apps distributing the malware.
Check Point Research discovered four SharkBot dropper applications on Google Play that masqueraded as antivirus or cleaner apps and were tied to malicious developer accounts.
Cleafy Threat Intelligence discovered the SharkBot Android banking trojan at the end of October 2021 and assessed from early samples that it was likely still under development and operating as a private botnet.
ThreatFabric had previously discovered the Vultur Android banking trojan, which it linked to the Brunhilda Project crew and described as using screen-streaming and VNC-based remote session capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
threatfabric.com
Open sourceblog.fox-it.com
Open sourceresearch.checkpoint.com
Open sourcecleafy.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026
Researchers reported multiple **Google Play Store** campaigns distributing the **Hydra** Android banking trojan through seemingly benign dropper apps. One campaign used a fake **"Document Manager"** app that drew more than **10,000 downloads** and prompted users to install a supposed update, which fetched a second-stage APK from attacker-controlled infrastructure. Earlier analysis of Hydra-linked droppers found similar Play Store distribution between 2018 and 2019, with malware using overlay attacks to steal banking credentials and targeting users in specific regions, including checks for Turkish devices and later activity aligned with campaigns against users in Colombia. Technical analysis showed Hydra operators separating the downloader from the banking payload to reduce detection. Samples used minimal initial permissions such as `REQUEST_INSTALL_PACKAGES`, then unpacked additional components through dropped DEX files, including one case where the payload was reconstructed from a PNG asset using steganography-like methods and loaded via the native library `libhoter.so`. Once installed, Hydra variants were observed stealing **SMS messages, cookies, OTPs, and device lock PINs**, abusing **Accessibility Services** to hinder removal, and using command-and-control infrastructure, including **TOR-related communications**, to manage infections and deliver malicious modules.
Aug 15, 2026
**TeaBot** (also tracked as **Anatsa**) infected Android devices through smishing campaigns and trojanized apps, including fake media, delivery, and utility software such as VLC, DHL, UPS, TeaTV, and QR-code scanners. Researchers found the malware later reached users through Google Play droppers that displayed fake update prompts and fetched second-stage APKs from GitHub, extending distribution beyond SMS lures. Campaigns initially focused on European banks, especially in Spain, Germany, and Italy, before expanding to roughly 400 targeted applications spanning banking, cryptocurrency, wallet, insurance, and other financial services in additional regions including the United States, Russia, and Hong Kong. Once installed, TeaBot abused Android **Accessibility Services** to gain broad control of the device, then hid its icon, intercepted SMS messages, logged keystrokes, captured screens, enumerated installed apps, and launched overlay attacks to steal credentials and 2FA codes from targeted apps. Analysts said the malware dynamically decrypted and loaded additional payloads, used partially XOR-encrypted command-and-control traffic, and in some cases terminated selected processes, including security tools, to reduce detection. Reports tied some second-stage payload delivery to GitHub repositories and noted that malicious Play Store apps had accumulated significant downloads before being identified and removed.
Aug 15, 2026