Loading story…
Researchers reported that the Android banking trojan Aberebot evolved into a new variant called Escobar, a malicious app disguised as trusted software such as Google Chrome and McAfee. The malware targets customers of more than 140 banks and financial institutions across 18 countries, while also phishing for credentials tied to services including PayPal, Gmail, MobiKwik, and Unocoin. Earlier Aberebot samples used phishing pages hosted from a GitHub repository and relied on Telegram bot infrastructure for command-and-control and data exfiltration.
Escobar significantly expands the original malware's capabilities beyond banking theft by abusing Android accessibility and other dangerous permissions to steal Google Authenticator codes, intercept SMS and OTPs, monitor notifications, harvest contacts, call logs, files, and location data, and remotely control infected devices through VNC. The malware can also record audio, take photos, send SMS messages, inject web pages, uninstall apps, delete itself, and enumerate device and network information consistent with mobile discovery behavior such as MITRE ATT&CK T1421. Researchers said the malware was heavily obfuscated, actively developed, and advertised on a cybercrime forum, indicating continued investment by its operators.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
On 2022-03-10, Cyble reported that an Android malware sample masquerading as McAfee was Escobar, a new variant of Aberebot. The variant expanded capabilities to include stealing Google Authenticator codes, recording audio, taking photos, collecting files and location data, and remotely controlling devices via VNC.
On 2021-07-30, Cyble published analysis of Aberebot, an Android banking trojan masquerading as Google Chrome that used Telegram and GitHub-hosted phishing pages to steal credentials, SMS messages, OTPs, and contacts from victims across 18 countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
blog.cyble.com
Open sourceblog.cyble.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and Italy’s CERT-AGID reported that the Android banking trojan **Oscorp**, later tracked as **UBEL**, was distributed through a malicious APK site in Italy and evolved into a broader global campaign targeting more than 150 applications, including banking apps. The malware abused Android’s **Accessibility Service** to gain extensive control over infected devices, repeatedly coercing victims to grant accessibility, usage statistics, battery optimization exemptions, and sometimes device administrator privileges to maintain persistence and expand access. Once active, UBEL/Oscorp could steal credentials through phishing overlays rendered in a `WebView`, intercept SMS messages, place calls, trigger call forwarding, execute USSD requests, launch or remove apps, and block legitimate applications. Analysts also documented screen and audio capture via **WebRTC/STUN**, HTTP POST communications with command-and-control servers, and specialized theft functions including replacement of cryptocurrency wallet addresses and harvesting of Google Authenticator one-time codes; published indicators included malware hashes, package names, C2 domains, injection paths, and AES keys tied to the operation.
Aug 15, 2026
Security researchers reported that the Android malware family **Xbot** evolved from a stealthy SMS-focused trojan into a broader banking and ransomware threat distributed through third-party app markets rather than Google Play. The malware masqueraded as trusted apps including **Google Play**, **Opera Browser**, **Android Market**, and **Minecraft**, then hid its launcher icon after installation to avoid detection. Early variants primarily targeted users in Russia and Eastern Europe, monitoring incoming SMS messages for selected keywords, exfiltrating messages to command-and-control infrastructure, sending premium-rate texts, downloading additional APKs, and persisting across reboots. Later analysis found Xbot embedded in 22 malicious apps and expanded to phishing **Google Play** payment details and login credentials for multiple banking apps, including major Australian banks and at least one Russian bank. The trojan used activity hijacking and **WebView** overlays to present fake login and card-entry screens, stole SMS messages and contacts, abused device administrator privileges, and accepted remote commands from its operators. Researchers also found ransomware functions that could lock the device, set a password, encrypt files on external storage with a simple XOR routine, and demand a **$100 PayPal My Cash Card** payment, while added obfuscation and dormant call-recording code indicated active ongoing development.
Aug 15, 2026
Security researchers reported that leaked source code for the Android banking malware **GM Bot** enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including **Slempo**, **Bankosy**, **Acecard**, and **MazarBot**—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans. ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on **Google Play**. The newer malware, detected as `Trojan.Android/Spy.Banker.HW`, posed as **World Weather**, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than **2,800 infected devices**, and the hosting provider removed the C2 server after notification.
Aug 15, 2026