Loading story…
Doctor Web disclosed a new Android banking trojan family, Android.BankBot.Coper, that masqueraded as the official Bancolombia Personas app and targeted users in Colombia. The malware used a modular, multi-stage infection chain in which a dropper decrypted and installed additional components, abused Android Accessibility Services for device control, attempted to disable Google Play Protect, and deployed its main payload disguised as a system app named Cache plugin.
Once active, Coper maintained contact with command-and-control servers and supported banking fraud and device takeover functions including phishing overlays, interception of notifications and SMS messages, sending SMS and USSD requests, keylogging, and lock-screen manipulation. Doctor Web also reported strong self-protection features that monitored attempts to uninstall the app or revoke privileges and simulated button presses to block removal; published IoCs linked the campaign to malicious APKs, DEX files, package names, domains such as sportsstyle.club, fitnessstyle.xyz, and 4-u.wtf, and IP addresses 18.217.36.170 and 45.76.35.31.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Doctor Web publicly disclosed a newly discovered Android banking trojan family named Android.BankBot.Coper. The report said known samples masqueraded as the Bancolombia Personas app and targeted users in Colombia using a modular, multi-stage infection chain with anti-removal features.
A GitHub commit attributed to Ivan Korolev added new indicators of compromise for the Android.BankBot.Coper banking trojan, including sample hashes, package names, domains, and IP addresses linked to the campaign targeting Colombian users.
Dr.Web added detection for Android.BankBot.Coper.2 to its virus database. The malware encyclopedia entry identifies it as an Android banking trojan distributed by the Coper.1 dropper and disguised as a system app called Cache plugin.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
news.drweb.com
Open sourcenews.drweb.ru
Open sourcegithub.com
Open sourcevms.drweb.com
Open sourcevms.drweb.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT-AgID published a reverse-engineering analysis of **Coper**, an Android banking trojan built to compromise mobile devices through a small loader APK and a native library that decrypts and loads an additional DEX payload at runtime. The malware requests broad Android permissions and abuses **Accessibility Service**, **Device Admin**, SMS access, notification access, and background execution to steal messages and notifications, capture credentials through injects and keylogging, lock infected devices, and maintain persistence on the handset. The analysis found that Coper communicates with multiple hard-coded command-and-control domains over HTTP POST, protecting JSON data with **AES-128-ECB** while using **RC4** to decrypt components embedded in the app. Operators can issue commands to enable banking injects, send SMS messages, place calls, uninstall applications, suppress notifications, activate VNC-like remote control, and remove the malware itself. CERT-AgID also reported that some intrusive functions are delayed until after initial registration with the C2 infrastructure, suggesting the attackers selectively activate capabilities based on victim language or geography.
Aug 14, 2026
Researchers linked **Octo** and **Coper** to the Exobot malware lineage and described them as Android banking trojans built for large-scale **on-device fraud**. The malware abuses Android **Accessibility Services** and screen-capture features such as **MediaProjection** or VNC-style remote access to let operators view screens, steal credentials, intercept SMS and push notifications, log keystrokes, deploy overlay attacks, and remotely control infected devices while hiding activity with black-screen overlays, disabled notifications, and anti-removal tricks. Reports tied Octo’s rental operation to the actor known as **"Architect"** or **"goodluck"**, while later infrastructure analysis connected active C2 servers to broad international campaigns with tens of thousands of bots and hundreds of thousands of intercepted SMS messages. The trojans were distributed through malicious landing pages and rogue Android apps, including droppers published on **Google Play** that impersonated cleaners, screen recorders, Play Store installers, PDF viewers, and security tools. Observed campaigns used apps such as **Fast Cleaner**, **Pocket Screencaster**, **UniFile manager – PDF viewer**, and DawDropper-hosted utilities that fetched payloads from services like **GitHub** and **Firebase**. Initial Coper activity targeted Colombian banking users, but later campaigns expanded across Europe, the United States, Turkey, and other regions, with notable targeting of Spain, Portugal, Italy, Germany, Austria, Belgium, and Hungary.
Aug 15, 2026
Researchers reported that the Android banking trojan **Aberebot** evolved into a new variant called **Escobar**, a malicious app disguised as trusted software such as Google Chrome and McAfee. The malware targets customers of more than **140 banks and financial institutions across 18 countries**, while also phishing for credentials tied to services including **PayPal**, **Gmail**, **MobiKwik**, and **Unocoin**. Earlier Aberebot samples used phishing pages hosted from a GitHub repository and relied on **Telegram** bot infrastructure for command-and-control and data exfiltration. Escobar significantly expands the original malware's capabilities beyond banking theft by abusing Android accessibility and other dangerous permissions to steal **Google Authenticator** codes, intercept **SMS** and OTPs, monitor notifications, harvest contacts, call logs, files, and location data, and remotely control infected devices through **VNC**. The malware can also record audio, take photos, send SMS messages, inject web pages, uninstall apps, delete itself, and enumerate device and network information consistent with mobile discovery behavior such as **MITRE ATT&CK `T1421`**. Researchers said the malware was heavily obfuscated, actively developed, and advertised on a cybercrime forum, indicating continued investment by its operators.
Aug 15, 2026