Loading story…
Two Android apps on Google Play, "Crypto Monitor" and "StorySaver," were found distributing the banking trojan Android/Spy.Banker.QL, which targeted customers of 14 Polish banks. After installation, the malware checked whether specific banking apps were present on the device, then displayed fake login overlays and fraudulent notifications to steal credentials from victims using legitimate mobile banking applications.
The malware also intercepted SMS messages, allowing attackers to bypass SMS-based two-factor authentication and gain deeper access to compromised accounts. The apps were uploaded in late November, drew an estimated 1,000 to 5,000 downloads, and were removed after being reported to Google on December 4. ESET said 96% of detections were in Poland and 4% in Austria, indicating a highly localized campaign aimed primarily at Polish banking users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ESET reported the two malicious Google Play apps to Google after they had accumulated an estimated 1,000 to 5,000 downloads combined. At that point, the apps were being used to steal banking credentials and intercept SMS messages from users of targeted Polish banking apps.
The Android app "StorySaver," posing as a tool for downloading Instagram stories, appeared on Google Play under the developer name "kirillsamsonov45." It also carried the banking malware targeting Polish banking app users.
The Android app "Crypto Monitor," masquerading as a cryptocurrency price tracker, was uploaded to Google Play under the developer name "walltestudio." It distributed the banking malware later detected by ESET as Android/Spy.Banker.QL.
A similar Android banking trojan disguised as a different app had previously been identified on Google Play by RiskIQ and described in a November 9 report.
Google removed "Crypto Monitor" and "StorySaver" from Google Play after ESET reported them. The apps had been distributing Android/Spy.Banker.QL to target customers of 14 Polish banks.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026