Loading story…
A financially motivated group is targeting Indonesian and Vietnamese Android users with banking trojans disguised as government and payment apps. The campaign uses spoofed Google Play Store pages and a WebSocket-based APK delivery mechanism to evade detection. The trojans, primarily BankBot variants, steal credentials and bypass two-factor authentication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Security reporting identified 'BlockBlasters' on Steam as being used to deliver malware to users. The event marks a software distribution abuse case in which a game platform listing was leveraged for malware delivery.
Researchers revealed a campaign using a legitimate tool as part of the infection chain to deploy remote access trojans. The disclosure highlighted abuse of trusted software to evade suspicion and gain persistent access.
A malware campaign targeting Android users in Southeast Asia was disclosed, using trojans disguised as government and payment applications. The operation focused on credential and financial theft through impersonated mobile apps.
Researchers reported on Kawa4096 as a newly identified ransomware group, noting branding similarities to Akira and ransom-note characteristics resembling Qilin. The disclosure marks the public emergence of a distinct ransomware operation.
Researchers disclosed a malicious IIS module campaign, also reported as BadIIS, that hijacks websites by redirecting traffic and planting web shells on compromised Microsoft IIS servers. The reporting describes a web-server malware operation affecting site integrity and visitor traffic.
GitHub announced new npm supply-chain security requirements mandating two-factor authentication and short-lived publishing tokens. The move was presented as a hardening measure to reduce account compromise and package publishing abuse.
Security researchers discovered a malicious npm package named 'fezbox' that concealed a second-stage payload in a QR code image to deliver cookie- and credential-stealing malware. Multiple outlets reported the same package and technique, indicating a single newly disclosed supply-chain malware event.
11 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedarkreading.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple new Android malware campaigns have been identified targeting users' financial data and payment methods. Researchers uncovered advanced banking trojans such as BankBot-YNRK and DeliveryRAT, which harvest sensitive information from compromised devices and employ sophisticated evasion techniques, including emulator detection and device-specific targeting. These trojans often masquerade as legitimate apps, such as Indonesia's digital ID application, and can mute device notifications to avoid detection by victims. In addition, a next-generation Android banking trojan has been observed hiding within digital ID apps, automating the theft of cryptocurrency wallets and evading analysis environments. A separate large-scale scam involves over 760 malicious Android apps exploiting NFC and HCE technologies to steal payment card data globally. These apps facilitate unauthorized transactions by leveraging contactless payment features. The surge in Android-targeted financial malware highlights the growing risk to users' banking credentials, payment cards, and cryptocurrency assets, with attackers employing increasingly sophisticated methods to bypass security controls and evade user awareness.
Jun 29, 2026
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026