Loading story…
Security researchers reported multiple Android malware campaigns that used droppers distributed through Google Play to install banking trojans and remote-access malware while evading marketplace defenses. Check Point detailed Clast82, a dropper embedded in trojanized utility apps that delayed malicious activity until after publication by checking a Firebase-controlled enable flag, then fetched payloads from GitHub and pushed victims to allow installs from unknown sources through repeated fake Google Play Services prompts. The campaign delivered AlienBot Banker and MRAT, relied on fake developer accounts and shared infrastructure, and led to the removal of the identified apps from Google Play.
Trend Micro later described DawDropper as a similar Android dropper operation that also abused Firebase Realtime Database and GitHub to dynamically retrieve payloads and avoid detection in apps posing as document scanners, cleaners, and QR scanners. DawDropper was used to distribute banking malware including Octo, Hydra, Ermac, and TeaBot; researchers said Octo could steal banking credentials, intercept SMS messages, disable Google Play Protect, hijack devices, and use VNC-based remote screen control while hiding its activity. The findings also tied these campaigns to a broader underground market for dropper-as-a-service (DaaS) offerings, showing how commodity delivery infrastructure was being used to scale Android banking malware distribution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Trend Micro's IOC list included the DawDropper sample com.scando.qukscanner, detected as AndroidOS_DawDropper.HRX, which used a Firebase database and downloaded an Octo payload from raw.githubusercontent.com.
Trend Micro's IOC list included the DawDropper sample com.casualplay.leadbro, detected as AndroidOS_DawDropper.HRXA, which used a Firebase database and downloaded a Hydra payload from GitHub.
Trend Micro said it observed the DawDropper Android banking malware dropper campaign in the latter part of 2021. The dropper was used in Google Play apps to distribute Octo, Hydra, Ermac, and TeaBot.
Trend Micro said the Vultur dropper, also known as Brunhilda, was first reported as a dropper-as-a-service offering at the end of 2020.
Trend Micro reported the DawDropper campaign and said the malicious apps masquerading as utilities such as document scanners and cleaners were no longer available on Google Play by the time of reporting.
By February 9, Google confirmed that all identified Clast82 applications had been removed from the Google Play Store.
Check Point Research reported the Clast82 campaign to Google on January 28 after identifying the malicious Google Play apps and their payload delivery infrastructure.
Check Point Research said it initially discovered the Clast82 Android dropper campaign on Google Play on January 27. The campaign used trojanized apps to deliver AlienBot Banker and MRAT payloads.
3 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourceresearch.checkpoint.com
Open sourceprodaft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Android apps on Google Play, **Currency Converter** and **BatterySaverMobi**, were found distributing the **Anubis** banking trojan through a dropper chain that prompted users to install a fake system update. The malware used motion-sensor checks to evade sandboxes and emulators, pulled command-and-control details from Telegram and Twitter content, and was linked to infrastructure including the domain `aserogeege.space` and IP address `47.254.26.2`. Once installed, Anubis targeted banking users across **93 countries** and **377 financial app variants**, stealing credentials through keylogging and screenshots while also abusing accessibility services to access contacts, location, audio, SMS, calls, and storage. Technical analysis showed the Anubis payload was heavily protected with reflection, obfuscation, runtime class loading, and encrypted `.dex` files, complicating static inspection. Researchers demonstrated that dynamic instrumentation with **Frida** could trace reflection calls, intercept file deletion, and preserve decrypted payloads dropped at runtime, while alternative methods recovered `.dex` remnants from memory or extracted the RC4 key and C2 configuration directly from the APK. Google removed the malicious apps from the Play Store after the abuse was confirmed, but the case highlighted how mobile banking malware can combine trusted distribution channels, anti-analysis tricks, and layered packing to hinder detection and reverse engineering.
Aug 15, 2026
Researchers reported multiple **Google Play Store** campaigns distributing the **Hydra** Android banking trojan through seemingly benign dropper apps. One campaign used a fake **"Document Manager"** app that drew more than **10,000 downloads** and prompted users to install a supposed update, which fetched a second-stage APK from attacker-controlled infrastructure. Earlier analysis of Hydra-linked droppers found similar Play Store distribution between 2018 and 2019, with malware using overlay attacks to steal banking credentials and targeting users in specific regions, including checks for Turkish devices and later activity aligned with campaigns against users in Colombia. Technical analysis showed Hydra operators separating the downloader from the banking payload to reduce detection. Samples used minimal initial permissions such as `REQUEST_INSTALL_PACKAGES`, then unpacked additional components through dropped DEX files, including one case where the payload was reconstructed from a PNG asset using steganography-like methods and loaded via the native library `libhoter.so`. Once installed, Hydra variants were observed stealing **SMS messages, cookies, OTPs, and device lock PINs**, abusing **Accessibility Services** to hinder removal, and using command-and-control infrastructure, including **TOR-related communications**, to manage infections and deliver malicious modules.
Aug 15, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026