Loading story…
Attackers have been running an Android malware campaign against customers of eight Malaysian banks by posing as local businesses, including cleaning services and a pet store, through fake e-commerce websites promoted with Facebook ads and lookalike domains. Victims who click bogus Google Play download buttons on the copycat sites receive malicious Android apps hosted on attacker-controlled servers rather than the official app store.
The malware steals online banking credentials by presenting a fake FPX payment page and then intercepts two-factor authentication by forwarding all incoming SMS messages to the attackers. ESET linked several of the malicious apps to the same threat actor through shared code and said the operation, first spotted in late 2021, was still active with newly registered distribution domains.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
In January 2022, MalwareHunterTeam shared three additional malicious websites and Android trojans that ESET attributed to the same threat actor behind the Malaysian fake e-shop campaign. This expanded the known infrastructure associated with the operation.
ESET reported that the Android malware campaign targeting customers of Malaysian banks through fake e-shop websites and malicious apps was first identified at the end of 2021. The activity impersonated local services and aimed to steal banking credentials and SMS-based 2FA codes.
ESET reported that the fake e-shop campaign was still active as of its April 2022 publication, with newly registered domains continuing to distribute malicious Android apps. The operation impersonated multiple Malaysian cleaning services and a pet store to target customers of eight banks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new wave of Android malware is leveraging sophisticated techniques to evade detection and compromise user devices. The Cellik malware-as-a-service (MaaS) platform enables cybercriminals to create trojanized versions of legitimate Google Play Store apps, embedding malicious payloads while preserving the original app's interface and functionality. This approach allows attackers to bypass security controls such as Play Protect and remain undetected for extended periods. Cellik offers features including real-time screen streaming, notification interception, filesystem browsing, data exfiltration, and a hidden browser mode for session hijacking, all managed through an encrypted command-and-control channel. In parallel, other Android malware campaigns such as NexusRoute and FvncBot are targeting users by impersonating trusted government and banking applications. NexusRoute focuses on Indian citizens by distributing fake mParivahan and e-Challan apps through phishing sites and GitHub repositories, enabling credential theft, device surveillance, and unauthorized financial transactions. FvncBot, meanwhile, disguises itself as a banking-security app and exploits accessibility and VNC features to capture keystrokes, stream screens, and inject fraudulent transactions within genuine banking apps. These developments highlight the increasing sophistication and commercial availability of Android malware, posing significant risks to mobile users and financial institutions alike.
Jun 29, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026