BianLian Android Banking Trojan Expanded Stealth, Remote Access, and App Targeting
Malware Intelligence · 6 sources · Updated 3mo ago · First seen Jun 9, 2022
Researchers documented multiple evolutions of the BianLian Android banking trojan, showing a malware family that abuses Accessibility Services to seize control of infected devices, hide its launcher icon, deploy overlay attacks, intercept SMS, execute USSD commands, lock screens, and target banking and cryptocurrency users. Fortinet reported a heavily obfuscated variant that dynamically loads a secondary APK downloaded from command-and-control infrastructure rather than decrypting it from app assets, and noted that the payload checks whether Google Play Protect is enabled through the SafetyNet API.
Later analysis of a newer sample found BianLian continuing to broaden both its infrastructure and victim scope, using a Tor onion service to deliver a Base64-encoded JSON configuration containing multiple C2 domains and targeting 438 mobile applications, primarily banking apps. The malware also added or refined remote-access capabilities including screen recording via MediaProjection and a SOCKS5/SSH proxy with remote port forwarding, while reorganizing code to improve persistence and evasion on major Android vendors by handling battery optimizations, disabling Huawei and Samsung protections, and enabling autostart on Xiaomi MIUI devices.
