Loading story…
Researchers reported that SoumniBot, an Android banking Trojan targeting users in South Korea, abuses weaknesses in APK and AndroidManifest.xml handling to evade detection and frustrate analysis tools. The malware uses malformed ZIP compression values, incorrect manifest size fields, and unusually long XML namespace names, allowing the malicious app to install on Android devices while causing some security and inspection tools to fail; the report noted that Google’s apkanalyzer could not properly process certain samples, and Google was notified.
Once executed, SoumniBot retrieves configuration data for exfiltration and MQTT-based command-and-control, hides its app icon, and continuously uploads contacts, messages, account details, and device information. It can also receive commands to steal more data, alter contacts and device settings, send SMS messages, and enumerate installed apps, with a notable focus on locating Korean online banking certificate files under /NPKI/yessign, archiving them, and sending them to its command-and-control server.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
The researchers reported to Google that SoumniBot abuses weaknesses in Android APK manifest handling and that Google's apkanalyzer cannot properly process some malformed manifests used by the malware.
Researchers identified SoumniBot as a newly discovered Android banking Trojan targeting Korean users. Their analysis documented its unusual AndroidManifest.xml obfuscation, data theft behavior, MQTT-based command-and-control, and theft of Korean online banking certificate files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026
A sophisticated Android banking Trojan, identified as Android/BankBot-YNRK, has been discovered targeting users primarily in Indonesia and potentially other Southeast Asian countries. The malware disguises itself as legitimate applications, including news readers and digital ID apps such as "Identitas Kependudukan Digital," to trick users into installation. Once installed, it leverages Android's accessibility features and device administrator privileges to gain extensive control over the device, allowing it to read on-screen content, simulate user actions, and overlay fake login screens on top of real banking and cryptocurrency apps to harvest credentials. The Trojan employs advanced evasion techniques, such as checking for emulators to avoid detection, obfuscating its code, and muting device notifications to operate stealthily. It connects to a remote command-and-control server to exfiltrate sensitive data, including banking credentials and cryptocurrency wallet keys, and can receive further instructions to update itself or erase traces. The malware's primary objective is financial theft, enabling attackers to drain victims' bank accounts and crypto wallets without their knowledge. Security researchers note that the malware's abuse of accessibility permissions is mitigated in Android 14, which requires explicit user approval for such access, but devices running Android 13 and earlier remain vulnerable.
Jun 29, 2026
The **S.O.V.A.** Android malware has been documented as a banking trojan and botnet under active development, with samples masquerading as legitimate apps including **Adobe Flash Player** and **Minecraft**. Researchers found it targets Android 7 through 11, relies heavily on abused **Accessibility**, notification listener, and default SMS permissions, and performs regional exclusion checks to avoid devices associated with CIS countries. Once launched, it can register infected devices with command-and-control infrastructure, start multiple background services, hide itself from the app list, resist device locking, and evade analysis through anti-emulation checks. S.O.V.A. is designed to steal a wide range of data, including **banking credentials, cookies, SMS messages, push notifications, clipboard contents, and keystrokes**, while also overlaying fake login pages on banking and cryptocurrency applications. Analysis of newer samples showed added botnet-style behavior such as cryptocurrency clipboard hijacking, root-status reporting, encrypted logging using Base64-wrapped `RC4`, and Retrofit2-based C2 communications, alongside previously observed support for hidden notification interception, SMS sending, and DDoS-related commands. Researchers also noted the malware’s roadmap included broader Android version support, **MiTM**, **ransomware**, **VNC**, Telegram-based C2, and more automated injection features.
Aug 14, 2026