Loading story…
Two Android apps on Google Play, Currency Converter and BatterySaverMobi, were found distributing the Anubis banking trojan through a dropper chain that prompted users to install a fake system update. The malware used motion-sensor checks to evade sandboxes and emulators, pulled command-and-control details from Telegram and Twitter content, and was linked to infrastructure including the domain aserogeege.space and IP address 47.254.26.2. Once installed, Anubis targeted banking users across 93 countries and 377 financial app variants, stealing credentials through keylogging and screenshots while also abusing accessibility services to access contacts, location, audio, SMS, calls, and storage.
Technical analysis showed the Anubis payload was heavily protected with reflection, obfuscation, runtime class loading, and encrypted .dex files, complicating static inspection. Researchers demonstrated that dynamic instrumentation with Frida could trace reflection calls, intercept file deletion, and preserve decrypted payloads dropped at runtime, while alternative methods recovered .dex remnants from memory or extracted the RC4 key and C2 configuration directly from the APK. Google removed the malicious apps from the Play Store after the abuse was confirmed, but the case highlighted how mobile banking malware can combine trusted distribution channels, anti-analysis tricks, and layered packing to hinder detection and reverse engineering.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Pentest Blog released a technical walkthrough showing how to unpack Anubis by tracing reflection with Frida, intercepting file deletion, recovering decrypted dex files, and extracting RC4 keys and command-and-control data. The article documented both dynamic and static approaches for recovering the malware payload and configuration.
Trend Micro disclosed that the droppers recovered command-and-control information from Telegram and Twitter pages, connected to the domain aserogeege.space, and deployed an Anubis payload capable of keylogging, screenshots, accessibility abuse, and broader device access. The report also said the latest Anubis version had spread across 93 countries and targeted 377 financial app variants.
Trend Micro reported that malicious domains tied to Anubis infrastructure may have switched IP addresses six times since October 2018, indicating active infrastructure rotation. The domains were associated with the IP address 47.254.26.2 and related command-and-control activity.
Pentest Blog stated that in the prior fall there were at least forty Google Play cases involving Anubis droppers targeting Turkish users. These apps used generic names and served as distribution vehicles for the banking malware.
After confirmation of abuse, Google removed the malicious apps Currency Converter and BatterySaverMobi from Google Play. One of the apps, BatterySaverMobi, had accumulated more than 5,000 downloads before removal.
Trend Micro discovered that the Android apps Currency Converter and BatterySaverMobi on Google Play were acting as droppers for the Anubis banking malware. The apps used motion-sensor-based anti-analysis checks and attempted to trick users into installing a secondary APK via a fake system update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
pentest.blog
Open sourceblog.trendmicro.com
Open sourcefrida.re
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Android apps published on Google Play, **Currency Converter** and **BatterySaverMobi**, were found to function as droppers for the **Anubis** banking trojan. The apps used motion-sensor checks to detect whether they were running on a real device rather than in a sandbox or emulator, then fetched command-and-control details through encoded requests tied to Telegram and Twitter pages. After installation, they displayed a fake system update prompt designed to persuade users to sideload a malicious APK that delivered the Anubis payload. Once deployed, Anubis was capable of targeting **377 financial app variants across 93 countries** and stealing data through keylogging, screenshots, abuse of Android accessibility features, and broad device permissions. Researchers linked the activity to infrastructure including the domain `aserogeege.space`, and Google removed both malicious apps from the Play Store after the discovery.
Jun 29, 2026
Security researchers reported multiple Android malware campaigns that used droppers distributed through **Google Play** to install banking trojans and remote-access malware while evading marketplace defenses. Check Point detailed **Clast82**, a dropper embedded in trojanized utility apps that delayed malicious activity until after publication by checking a Firebase-controlled `enable` flag, then fetched payloads from GitHub and pushed victims to allow installs from unknown sources through repeated fake **Google Play Services** prompts. The campaign delivered **AlienBot Banker** and **MRAT**, relied on fake developer accounts and shared infrastructure, and led to the removal of the identified apps from Google Play. Trend Micro later described **DawDropper** as a similar Android dropper operation that also abused **Firebase Realtime Database** and **GitHub** to dynamically retrieve payloads and avoid detection in apps posing as document scanners, cleaners, and QR scanners. DawDropper was used to distribute banking malware including **Octo**, **Hydra**, **Ermac**, and **TeaBot**; researchers said Octo could steal banking credentials, intercept SMS messages, disable **Google Play Protect**, hijack devices, and use **VNC-based** remote screen control while hiding its activity. The findings also tied these campaigns to a broader underground market for **dropper-as-a-service (DaaS)** offerings, showing how commodity delivery infrastructure was being used to scale Android banking malware distribution.
Aug 14, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026