Loading story…
Check Point Research detailed FakeCalls, an Android banking trojan targeting South Korean users by impersonating more than 20 financial applications and tricking victims into believing they are speaking with legitimate bank representatives. The malware is designed to steal private and financial information while exploiting South Korea’s established voice-phishing ecosystem, turning infected devices into tools for social engineering as well as credential and data theft.
Researchers identified more than 2,500 FakeCalls samples and found that the malware also supports payload delivery, live audio and video streaming from compromised phones, and concealed command-and-control discovery through Google Drive and other dead-drop resolvers. The report also documented three unusual anti-analysis techniques in the APK structure and contents that complicate reverse engineering, underscoring the malware’s sophistication and the risk that its tradecraft could be adapted for campaigns beyond South Korea.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published an analysis of the FakeCalls Android banking trojan targeting South Korea. The report documented more than 2,500 samples, impersonation of over 20 financial apps, voice-phishing features, live audio/video streaming, dead-drop C2 resolution, and novel anti-analysis techniques.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Android spyware campaign targeted Korean-speaking users through phishing pages impersonating **Woori Bank** and promoting fraudulent loan offers. Victims were prompted to install a fake version of the bank’s **WON** app, which abused Android **Accessibility Service** to obtain broad permissions and harvest sensitive data, including contacts, SMS messages, call logs, audio, video, GPS location, installed app lists, screen text, and information entered into embedded fake web pages. The malware used layered evasion and persistence techniques to hinder analysis and maintain access on infected devices. Researchers reported packed and obfuscated components, encrypted secondary `DEX` payloads, anti-sandbox checks, and encrypted command-and-control communications, with one server address retrieved through GitHub. The spyware also monitored device events such as `BOOT_COMPLETED` and outgoing calls, reflecting a financially themed mobile espionage operation that combined social engineering with native Android abuse and obfuscated code to sustain surveillance of South Korean victims.
Aug 15, 2026
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026