Loading story…
The Android banking trojan Red Alert was observed targeting more than 60 banking applications across multiple countries, along with at least one social platform, Instagram, by displaying fake login overlays when victims opened selected apps. The malware checked which application was in the foreground and then pulled the appropriate overlay configuration from its command-and-control infrastructure, allowing it to capture usernames, passwords, and other entered data and send them back to attackers.
Researchers reported that Red Alert 2.0 was being distributed through third-party Android app stores while posing as legitimate software such as WhatsApp, Viber, Android updates, and Flash Player updates. Beyond credential theft, the trojan supported SMS interception and sending, changing the default SMS app, collecting contacts and call data, issuing USSD commands, launching apps, requesting admin privileges, and blocking incoming calls from banks to interfere with fraud checks; it was also reportedly advertised on underground forums for $500, raising concerns that more criminals could deploy it against Android devices up to version 6.0.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that Red Alert 2.0 was being distributed through third-party app stores while masquerading as apps such as WhatsApp, Viber, Android updates, and Flash Player updates. The report said the malware used overlays to steal credentials, intercepted SMS messages, and blocked incoming bank calls.
ThreatFabric described the Android banking trojan Red Alert, detailing its overlay-based credential theft, command-and-control design, and command set. The report said the malware targeted more than 60 banking apps across multiple countries as well as Instagram.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Multiple reports highlight evolving **Android** threats that abuse SMS/telephony access and advanced evasion to enable fraud, surveillance, and account takeover. CloudSEK described a shift from repackaged apps to **runtime manipulation** using the *LSPosed* framework, where a malicious module (e.g., **Digital Lutera**) hooks `SmsManager` and `TelephonyManager` to undermine India’s **UPI SIM-binding** controls. The technique can intercept registration tokens and 2FA, spoof device identity/phone number, and exfiltrate data to **Telegram**; it also uses **Socket.IO** for real-time C2 and can remotely inject fabricated SMS entries into the device’s “Sent” database to make bank backends believe a SIM is present on a different device, enabling scalable payment fraud and account takeover. Separately, Acronis TRU (reported by Hackread) identified a **fake Red Alert** rocket-warning app distributed via SMS lures impersonating Israel’s Home Front Command; the trojanized app displays legitimate alerts to reduce suspicion while requesting extensive permissions to steal **GPS location**, **SMS/OTP**, contacts, installed-app inventory, and on-device account details, then exfiltrates data to a remote server, including via **certificate spoofing** and UI tricks to appear Play Store-installed. Zimperium reported a new Android RAT, **SurxRAT**, that can download and run **LLM modules** from third-party repositories to automate phishing and social engineering and to interact with apps/UI for credential theft and data exfiltration, reinforcing the need for behavior-based mobile detection, tighter app controls, and stronger integrity enforcement (e.g., *Play Integrity API* with `MEETS_STRONG_INTEGRITY`) where applicable.
Jun 29, 2026
Researchers reported **RedWing**, a newly identified Android spyware and malware-as-a-service operation marketed through Telegram and distributed via sideloaded apps and mobile phishing pages. The service packages custom droppers, fake app-store lures, phishing templates, operator guides, and subscription tiers that lower the barrier for bank-fraud actors. Investigators said the campaign heavily targets financial institutions—especially Russian banks and crypto services—and currently includes targeting for **82 institutions** across multiple sectors, with infrastructure and tradecraft suggesting a strong Russian-market orientation. Once installed and granted permissions, RedWing gives operators extensive control over infected devices by abusing Android **Accessibility Services**, overlay permissions, default SMS handler privileges, and **MediaProjection**. The malware can harvest credentials and one-time codes, intercept SMS, enable call forwarding, stream the screen, log keystrokes, capture audio and camera feeds, and access files, contacts, call logs, and location, allowing it to bypass SMS- and voice-based 2FA. Researchers also found similarities to the **Oblivion** malware family and said RedWing can dynamically update targeted apps and phishing overlays from its command-and-control panel without requiring a new malware build.
Aug 11, 2026