Loading story…
A malicious Android app disguised as an Adobe Flash Player update was found acting as a trojan downloader that silently fetched and installed additional malware on infected devices. Detected as Android/TrojanDownloader.Agent.JI, the app abused Android Accessibility Service permissions to mimic user clicks, conceal its actions behind a fake lock screen, and automatically download, install, execute, and grant elevated privileges to secondary payloads without the victim’s awareness.
The malware was distributed through compromised websites, including adult video pages, and through social media lures urging users to install a fake Flash update. After infection, it contacted a command-and-control server, transmitted device details, and received a URL for a follow-on app; in the observed case, the secondary payload was banking malware identified as Android/Spy.Banker.HD. Investigators said victims could spot the infection by checking for a rogue accessibility service named “Saving battery” and removing the fake Flash Player app, including revoking device administrator rights if necessary.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
ESET Research reported a malicious Android app masquerading as an Adobe Flash Player update and detecting it as Android/TrojanDownloader.Agent.JI. The trojan was distributed via compromised websites and social media, abused Accessibility Service permissions to mimic clicks, and in an observed case downloaded banking malware detected as Android/Spy.Banker.HD.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**AntiDot** is being used as an Android banking trojan and malware-as-a-service (**MaaS**) platform that masquerades as fake **Google Play** update apps to trick victims into enabling Accessibility permissions and installing a multi-stage implant. Reporting links the malware to threat actor **LARVA-398** and describes broad, localized targeting through multiple language lures, malicious advertising networks, and some phishing campaigns aimed at users of cryptocurrency, banking, and payment applications. Once installed, AntiDot abuses Accessibility services for overlay attacks, keylogging, SMS theft, notification suppression, contact harvesting, USSD execution, call forwarding, and device locking or unlocking, while also enabling VNC-style remote control through **MediaProjection** and websocket-based command-and-control. Researchers reported at least **11 active C2 servers**, more than **3,775 infected devices**, and at least **273 campaigns**, with the malware using heavy obfuscation, dynamic code loading, backup C2 infrastructure, and a command set that supports app discovery, remote gestures, camera activation, SMS collection, and self-uninstallation.
Aug 15, 2026
Researchers identified a new **Svpeng** Android banking trojan variant, `Trojan-Banker.AndroidOS.Svpeng.ae`, that expanded the malware family’s capabilities by abusing Android accessibility services to capture keystrokes and other user activity. The malware can grant itself broad privileges, hinder removal, steal text entered into other applications, take screenshots, display phishing overlays on targeted apps, and receive commands from a command-and-control server. The campaign was observed in limited volumes across **23 countries**, with the largest shares in Russia, Germany, and Turkey, although the malware was designed not to run on devices using the Russian language setting. The sample was distributed through malicious websites posing as a fake **Flash Player** update, and researchers said the technique remained effective even against fully updated Android devices.
Aug 14, 2026
Researchers identified **OverlayPhantom**, a previously undocumented Android banking trojan distributed through malicious URLs that impersonate trusted apps including Austria’s **ID Austria** and **TikTok**. The malware uses a two-stage infection chain: a dropper installs a payload disguised as **Google Play Services**, then abuses Android **Accessibility Service** to gain persistent control of the device. Investigators said the campaign has been active since early May 2025 and is aimed at large-scale financial fraud across Western markets. OverlayPhantom targets more than **180 banking, financial, and cryptocurrency applications** across **10 countries**, using embedded HTML overlay phishing pages to steal credentials and payment data. The malware also leverages Android’s **MediaProjection API** for near-real-time JPEG screen streaming and supports more than **30 remote commands**, including gesture simulation, clipboard manipulation, fake notifications, device locking, and PIN or password capture. Its command-and-control infrastructure was tied to `199.217[.]99[.]122`, using non-standard ports `9091`, `9092`, and `9090` for command execution, device reporting, and screen streaming.
Jun 29, 2026