Loading story…
Cybersecurity researchers have identified a new Android banking trojan named Datzbro, which is being used in targeted campaigns against elderly individuals. The Datzbro malware is distributed through fake Facebook groups that promote social activities and travel events specifically aimed at seniors. These groups use artificial intelligence-generated content to appear legitimate and attract elderly users seeking companionship and activities. Once a target expresses interest in an event, scammers contact them via Facebook Messenger or WhatsApp, urging them to download a malicious APK file from fraudulent websites such as 'download.seniorgroupapps[.]com.' The websites claim to offer a community application for event registration and member interaction, but in reality, they deliver the Datzbro trojan. The campaign was first detected in August 2025 by ThreatFabric after reports from Australian users, but it has also targeted individuals in Singapore, Malaysia, Canada, South Africa, and the U.K. The attackers have designed their infrastructure to potentially target both Android and iOS users, with placeholder links for iOS TestFlight apps, indicating a broader intent. On Android devices, the malware is sometimes delivered directly or via a dropper created with the Zombinder APK binding service, which helps bypass security restrictions on newer Android versions. Once installed, Datzbro can perform device takeover attacks, allowing threat actors to conduct fraudulent banking transactions and steal sensitive information. The malware is capable of hijacking devices, granting attackers extensive control and access to personal and financial data. The campaign's focus on the elderly makes it particularly concerning, as this demographic is often less familiar with mobile security best practices. The use of AI-generated content and social engineering tactics increases the likelihood of successful infections. Security experts warn that the campaign is ongoing and evolving, with attackers refining their methods to evade detection and expand their reach. The discovery of placeholder iOS links suggests that future campaigns may also target Apple device users. Researchers recommend heightened vigilance for seniors participating in online communities and urge the implementation of robust mobile security solutions. The incident highlights the growing sophistication of social engineering attacks leveraging popular platforms like Facebook to distribute malware. Law enforcement and cybersecurity organizations are monitoring the situation and advising potential victims to avoid downloading applications from unofficial sources. The Datzbro campaign underscores the need for increased awareness and education around mobile threats, especially among vulnerable populations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Reporting revealed that the Datzbro campaign used fake Facebook travel or event-themed content, including AI-generated material, to trick elderly users into installing the malware. The lures were designed to gain device access and facilitate credential and financial theft.
Security researchers reported a new Android malware family called Datzbro that targets older adults through social-engineering lures. The malware was described as combining spyware and banking-trojan capabilities to hijack victims' devices and steal sensitive information.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified a sophisticated scam campaign that targets seniors worldwide through Facebook groups promoting social activities, such as dance events, day trips, and community gatherings. The campaign first emerged in Australia in August, with users reporting suspicious Facebook groups that appeared to cater specifically to older adults. Cybersecurity firm ThreatFabric later discovered that the operation had expanded to other countries, including Singapore, Malaysia, Canada, South Africa, and the United Kingdom. The scammers use AI-generated content to make the Facebook group posts appear legitimate and engaging, successfully attracting hundreds of responses from potential victims. Once individuals express interest in the advertised events, the fraudsters initiate private conversations via Facebook Messenger or WhatsApp. During these conversations, victims are directed to fake registration websites that prompt them to download a so-called "community app" to participate in the activities. Instead of a legitimate app, the download link either directly installs the Datzbro Android malware or uses a dropper known as Zombinder to bypass security protections on newer Android devices. Datzbro is a newly emergent Android banking trojan with advanced spyware capabilities, including audio recording, camera access, file theft, and keylogging. The malware also features a remote control mode that allows attackers to exfiltrate on-screen information, steal lock screen PINs, and harvest credentials for financial services such as Alipay, WeChat, and cryptocurrency or bank accounts. The campaign leverages the trust and community orientation of seniors, making them particularly vulnerable to these social engineering tactics. The widespread availability of Datzbro's builder and command-and-control software, following a leak online, has increased the risk of further global proliferation. Security researchers warn that the combination of convincing AI-generated lures and sophisticated malware delivery mechanisms represents a significant evolution in mobile threat campaigns. The use of Zombinder as a dropper enables the malware to evade many standard Android security measures, increasing the likelihood of successful infections. The campaign's global reach and focus on a vulnerable demographic underscore the need for increased awareness and targeted security education for seniors. Financial fraud, device takeover, and credential theft are among the primary risks associated with this campaign. The incident highlights the growing trend of cybercriminals exploiting social media platforms and AI technologies to orchestrate large-scale, targeted attacks. Ongoing monitoring and collaboration between cybersecurity firms and social media companies are essential to disrupt such operations and protect at-risk populations.
Jun 29, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
A sophisticated Android banking Trojan, identified as Android/BankBot-YNRK, has been discovered targeting users primarily in Indonesia and potentially other Southeast Asian countries. The malware disguises itself as legitimate applications, including news readers and digital ID apps such as "Identitas Kependudukan Digital," to trick users into installation. Once installed, it leverages Android's accessibility features and device administrator privileges to gain extensive control over the device, allowing it to read on-screen content, simulate user actions, and overlay fake login screens on top of real banking and cryptocurrency apps to harvest credentials. The Trojan employs advanced evasion techniques, such as checking for emulators to avoid detection, obfuscating its code, and muting device notifications to operate stealthily. It connects to a remote command-and-control server to exfiltrate sensitive data, including banking credentials and cryptocurrency wallet keys, and can receive further instructions to update itself or erase traces. The malware's primary objective is financial theft, enabling attackers to drain victims' bank accounts and crypto wallets without their knowledge. Security researchers note that the malware's abuse of accessibility permissions is mitigated in Android 14, which requires explicit user approval for such access, but devices running Android 13 and earlier remain vulnerable.
Jun 29, 2026