Loading story…
The Android banking trojan BankBot expanded rapidly after the source code for its precursor, BankBotAlpha, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting Device Administrator privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for PrivatBank and Visa QIWI Wallet, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
ESET said the Google Play BankBot dropper activity continued into November 2017 as part of a second campaign. The second campaign used additional droppers and infrastructure to deliver BankBot samples.
ESET reported two Android malware campaigns in October and November 2017 that used apps uploaded to Google Play as droppers for BankBot banking malware. The campaigns relied on malicious or trojanized apps to infect users.
Variants of BankBotAlpha appeared rapidly after the source leak and had reached VirusTotal by early January 2017. Fortinet later counted 141 variants using the same internal package name.
Fortinet reported detecting its first BankBotAlpha sample shortly after the forum leak. This marked the malware's appearance in the wild beyond the original posting.
A user named "maza-in" advertised the BankBotAlpha Android banking malware project on a Russian forum and presented it as a tutorial for building an Android banker. The post made the source code and PHP command-and-control panel publicly available.
Fortinet described BankBot as an Android banking trojan family that first surfaced in the second half of 2016. Its purpose was to steal banking credentials from Android users.
New BankBot strains later appeared in third-party APK markets and the official Google Play Store. Fortinet said these newer samples remained very similar to the code leaked in late 2016 while adding broader app injection support and call-blocking logic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcefortinet.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that leaked source code for the Android banking malware **GM Bot** enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including **Slempo**, **Bankosy**, **Acecard**, and **MazarBot**—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans. ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on **Google Play**. The newer malware, detected as `Trojan.Android/Spy.Banker.HW`, posed as **World Weather**, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than **2,800 infected devices**, and the hosting provider removed the C2 server after notification.
Aug 15, 2026
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026
Two Android apps on Google Play, **"Crypto Monitor"** and **"StorySaver,"** were found distributing the banking trojan **`Android/Spy.Banker.QL`**, which targeted customers of 14 Polish banks. After installation, the malware checked whether specific banking apps were present on the device, then displayed fake login overlays and fraudulent notifications to steal credentials from victims using legitimate mobile banking applications. The malware also intercepted SMS messages, allowing attackers to bypass SMS-based two-factor authentication and gain deeper access to compromised accounts. The apps were uploaded in late November, drew an estimated **1,000 to 5,000 downloads**, and were removed after being reported to Google on December 4. ESET said **96%** of detections were in Poland and **4%** in Austria, indicating a highly localized campaign aimed primarily at Polish banking users.
Aug 14, 2026