Loading story…
Researchers identified a new Svpeng Android banking trojan variant, Trojan-Banker.AndroidOS.Svpeng.ae, that expanded the malware family’s capabilities by abusing Android accessibility services to capture keystrokes and other user activity. The malware can grant itself broad privileges, hinder removal, steal text entered into other applications, take screenshots, display phishing overlays on targeted apps, and receive commands from a command-and-control server.
The campaign was observed in limited volumes across 23 countries, with the largest shares in Russia, Germany, and Turkey, although the malware was designed not to run on devices using the Russian language setting. The sample was distributed through malicious websites posing as a fake Flash Player update, and researchers said the technique remained effective even against fully updated Android devices.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Over one observed week in mid-July 2017, researchers saw a small number of users attacked by the new Svpeng.ae variant across 23 countries. The highest shares of victims were in Russia, Germany, and Turkey, while the malware avoided running on devices set to Russian language.
In mid-July 2017, researchers identified Trojan-Banker.AndroidOS.Svpeng.ae, a new Svpeng variant for Android. The variant added keylogging by abusing Android accessibility services and could steal entered text, take screenshots, resist uninstallation, and deploy phishing overlays.
In 2016, attackers actively distributed Svpeng through AdSense by exploiting a Chrome browser vulnerability. This marked an earlier distribution campaign for the malware family before the newly analyzed variant appeared.
The Svpeng mobile malware family has been active since at least 2013 and was among the first families to target SMS banking. It also previously used phishing overlays and device-locking extortion tactics.
Researchers intercepted and decrypted an encrypted configuration file delivered from the malware's command-and-control server. The configuration revealed targeted apps, phishing URLs, antivirus apps the Trojan tried to block, and supported commands for SMS theft, contact collection, call-log collection, and URL opening.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **S.O.V.A.** Android malware has been documented as a banking trojan and botnet under active development, with samples masquerading as legitimate apps including **Adobe Flash Player** and **Minecraft**. Researchers found it targets Android 7 through 11, relies heavily on abused **Accessibility**, notification listener, and default SMS permissions, and performs regional exclusion checks to avoid devices associated with CIS countries. Once launched, it can register infected devices with command-and-control infrastructure, start multiple background services, hide itself from the app list, resist device locking, and evade analysis through anti-emulation checks. S.O.V.A. is designed to steal a wide range of data, including **banking credentials, cookies, SMS messages, push notifications, clipboard contents, and keystrokes**, while also overlaying fake login pages on banking and cryptocurrency applications. Analysis of newer samples showed added botnet-style behavior such as cryptocurrency clipboard hijacking, root-status reporting, encrypted logging using Base64-wrapped `RC4`, and Retrofit2-based C2 communications, alongside previously observed support for hidden notification interception, SMS sending, and DDoS-related commands. Researchers also noted the malware’s roadmap included broader Android version support, **MiTM**, **ransomware**, **VNC**, Telegram-based C2, and more automated injection features.
Aug 14, 2026
A newly discovered Android banking trojan named **Sturnus** has emerged, targeting financial institutions in Europe and demonstrating advanced capabilities beyond typical mobile malware. Sturnus can capture messages from end-to-end encrypted messaging apps such as Signal, WhatsApp, and Telegram by accessing content after decryption directly from the device screen. The malware also enables full device takeover, credential theft through region-specific HTML overlays, and real-time remote control via VNC sessions. Infection typically begins with malicious APKs disguised as legitimate apps like Google Chrome or Preemix Box, and the malware abuses Android Accessibility services to monitor user activity, capture keystrokes, and manipulate the device interface. Sturnus communicates with its command-and-control infrastructure using a combination of plaintext, RSA, and AES-encrypted channels, establishing secure connections for both data exfiltration and live monitoring. Once installed, it registers the victim device through a cryptographic exchange and can obtain Device Administrator privileges, allowing it to track password changes, lock the device, and maintain persistence. The trojan is currently under active development and is believed to be distributed via malvertising or direct messages, with researchers noting its private operation and ongoing evaluation phase. Security experts warn that Sturnus represents a significant escalation in Android banking malware sophistication, particularly due to its ability to bypass encrypted messaging protections and facilitate financial fraud.
Jun 29, 2026
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026