Escobar Android Malware Emerges as More Capable Variant of Aberebot

Researchers reported that the Android banking trojan Aberebot evolved into a new variant called Escobar, a malicious app disguised as trusted software such as Google Chrome and McAfee. The malware targets customers of more than 140 banks and financial institutions across 18 countries, while also phishing for credentials tied to services including PayPal, Gmail, MobiKwik, and Unocoin. Earlier Aberebot samples used phishing pages hosted from a GitHub repository and relied on Telegram bot infrastructure for command-and-control and data exfiltration.

Escobar significantly expands the original malware's capabilities beyond banking theft by abusing Android accessibility and other dangerous permissions to steal Google Authenticator codes, intercept SMS and OTPs, monitor notifications, harvest contacts, call logs, files, and location data, and remotely control infected devices through VNC. The malware can also record audio, take photos, send SMS messages, inject web pages, uninstall apps, delete itself, and enumerate device and network information consistent with mobile discovery behavior such as MITRE ATT&CK T1421. Researchers said the malware was heavily obfuscated, actively developed, and advertised on a cybercrime forum, indicating continued investment by its operators.