Loading story…
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal banking credentials, payment card data, and SMS one-time passwords. ESET reported that Trojans including BankBot, Anubis, Exobot, and MazarBot use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials.
The report said the leak of BankBot source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized QRecorder app distributed through Google Play that targeted banks in Germany, Poland, and the Czech Republic and was installed more than 10,000 times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In November 2018, ESET discovered an Android banking Trojan technique that abused Accessibility services to navigate targeted financial apps and transfer funds directly. The paper highlights this as an evolution beyond credential theft toward direct fraudulent transactions.
The report says fake banking apps were reported as increasing in prevalence throughout 2018. It identifies them as a growing category of Android banking malware alongside more sophisticated banking Trojans.
According to the white paper, the BankBot source code leak likely helped drive a surge of Android banking Trojan variants during 2017. This marked a broader escalation in Android banking malware activity.
The white paper states that BankBot source code was published on an underground forum in December 2016. It says this leak contributed to numerous hybrid variants of Android banking malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple new Android malware campaigns have been identified targeting users' financial data and payment methods. Researchers uncovered advanced banking trojans such as BankBot-YNRK and DeliveryRAT, which harvest sensitive information from compromised devices and employ sophisticated evasion techniques, including emulator detection and device-specific targeting. These trojans often masquerade as legitimate apps, such as Indonesia's digital ID application, and can mute device notifications to avoid detection by victims. In addition, a next-generation Android banking trojan has been observed hiding within digital ID apps, automating the theft of cryptocurrency wallets and evading analysis environments. A separate large-scale scam involves over 760 malicious Android apps exploiting NFC and HCE technologies to steal payment card data globally. These apps facilitate unauthorized transactions by leveraging contactless payment features. The surge in Android-targeted financial malware highlights the growing risk to users' banking credentials, payment cards, and cryptocurrency assets, with attackers employing increasingly sophisticated methods to bypass security controls and evade user awareness.
Jun 29, 2026
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026
Two Android apps on Google Play, **"Crypto Monitor"** and **"StorySaver,"** were found distributing the banking trojan **`Android/Spy.Banker.QL`**, which targeted customers of 14 Polish banks. After installation, the malware checked whether specific banking apps were present on the device, then displayed fake login overlays and fraudulent notifications to steal credentials from victims using legitimate mobile banking applications. The malware also intercepted SMS messages, allowing attackers to bypass SMS-based two-factor authentication and gain deeper access to compromised accounts. The apps were uploaded in late November, drew an estimated **1,000 to 5,000 downloads**, and were removed after being reported to Google on December 4. ESET said **96%** of detections were in Poland and **4%** in Austria, indicating a highly localized campaign aimed primarily at Polish banking users.
Aug 14, 2026