Loading story…
BasBanke, an Android banking Trojan aimed at Brazilian users, stole banking credentials, payment-card data, and other financial information through malicious mobile apps, including samples distributed on the official Google Play Store. The campaign began during Brazil’s 2018 elections and surpassed 10,000 installs by April 2019, showing that official app-store distribution and built-in protections such as Google Play Protect did not stop the malware’s spread.
The malware was promoted through Facebook and WhatsApp using lures such as fake utility tools, a bogus travel agency app, a fake profile-visitor app, and the widely distributed CleanDroid sample. Once installed, BasBanke supported keylogging, screen recording, SMS interception, and exfiltration of device metadata to a remote command-and-control server, while monitoring numerous Brazilian financial institutions and keywords tied to other popular brands and websites.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
By April 2019, BasBanke had registered more than 10,000 installations from the official Google Play Store alone, showing substantial reach through malicious apps hosted on the platform.
The BasBanke Android banking Trojan campaign began during the 2018 Brazilian elections, targeting Brazilian users with malware designed to steal banking credentials and payment card data.
Kaspersky's Securelist published a technical analysis describing BasBanke's capabilities, distribution via Facebook and WhatsApp, targeting of Brazilian financial institutions, and associated IOC hashes and domains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026
**Kaspersky** reported a new Android malware campaign dubbed **BeatBanker** targeting users in Brazil, distributed via phishing sites that closely mimic the *Google Play Store* and lure victims into installing trojanized APKs posing as legitimate apps such as **Starlink** and the Brazilian government services app **INSS Reembolso**. The infection chain is staged to reduce suspicion: an initial decoy app presents a fake in-app “update” flow that prompts users to grant permission to install additional apps/modules, after which the malware pulls down further payloads and requests expanded privileges. Technical reporting indicates BeatBanker blends **banking trojan** capabilities with **cryptomining** (including a modified *XMRig*), and newer variants may deploy the commodity Android RAT **BTMOB** in place of the banking module, enabling broad device takeover (e.g., keylogging, screen recording, camera access, GPS tracking, and credential capture). The malware uses evasion techniques such as decrypting and loading hidden DEX code in-memory, performing anti-analysis environment checks, delaying malicious actions post-install, and maintaining persistence by continuously playing a near-inaudible MP3 (`output8.mp3`) to keep a foreground service alive and reduce the likelihood of the process being suspended by Android power management.
Jun 29, 2026
Two Android apps on Google Play, **"Crypto Monitor"** and **"StorySaver,"** were found distributing the banking trojan **`Android/Spy.Banker.QL`**, which targeted customers of 14 Polish banks. After installation, the malware checked whether specific banking apps were present on the device, then displayed fake login overlays and fraudulent notifications to steal credentials from victims using legitimate mobile banking applications. The malware also intercepted SMS messages, allowing attackers to bypass SMS-based two-factor authentication and gain deeper access to compromised accounts. The apps were uploaded in late November, drew an estimated **1,000 to 5,000 downloads**, and were removed after being reported to Google on December 4. ESET said **96%** of detections were in Poland and **4%** in Austria, indicating a highly localized campaign aimed primarily at Polish banking users.
Aug 14, 2026