Loading story…
A new Android banking Trojan known as Klopatra has emerged, targeting users in Europe with sophisticated techniques to hijack bank accounts. Security researchers have identified Klopatra as a highly evasive malware that leverages hidden VNC (Virtual Network Computing) functionality to remotely control infected devices without the victim’s knowledge. The Trojan is capable of bypassing security barriers and executing fraudulent bank transfers while users are asleep, making detection and prevention particularly challenging. Klopatra employs commercial-grade obfuscation methods to evade antivirus and security solutions, increasing its persistence on compromised devices. Initial infections were observed as early as March, with a significant uptick in activity during the summer, resulting in over 3,000 confirmed infections across Italy and Spain. The malware is distributed through deceptive lures, including fake streaming service applications, which entice users to install malicious APK files. Once installed, Klopatra can intercept SMS messages, steal authentication codes, and manipulate banking applications to initiate unauthorized transactions. The Trojan’s hidden VNC capability allows attackers to interact with the device in real time, mimicking legitimate user behavior and circumventing security controls such as two-factor authentication. Victims are often unaware of the compromise, as the malware suppresses notifications and operates silently in the background. Security experts warn that Klopatra’s modular architecture enables rapid adaptation to new security measures and banking app updates. The campaign’s focus on European financial institutions highlights a growing trend of region-specific targeting by mobile malware operators. Researchers emphasize the importance of user education, robust mobile security solutions, and vigilance against unsolicited app installations to mitigate the risk posed by Klopatra. Financial organizations are advised to monitor for anomalous transactions and strengthen fraud detection mechanisms. The emergence of Klopatra underscores the evolving threat landscape for Android users, particularly in the context of mobile banking. Law enforcement and cybersecurity agencies are collaborating to track the distribution infrastructure and disrupt the operators behind the campaign. The use of commercial obfuscation tools by Klopatra sets a new standard for mobile malware stealth, complicating efforts to analyze and remediate infections. The incident serves as a reminder of the critical need for continuous monitoring and rapid response capabilities in the face of advanced mobile threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
A sophisticated Android banking Trojan, identified as Android/BankBot-YNRK, has been discovered targeting users primarily in Indonesia and potentially other Southeast Asian countries. The malware disguises itself as legitimate applications, including news readers and digital ID apps such as "Identitas Kependudukan Digital," to trick users into installation. Once installed, it leverages Android's accessibility features and device administrator privileges to gain extensive control over the device, allowing it to read on-screen content, simulate user actions, and overlay fake login screens on top of real banking and cryptocurrency apps to harvest credentials. The Trojan employs advanced evasion techniques, such as checking for emulators to avoid detection, obfuscating its code, and muting device notifications to operate stealthily. It connects to a remote command-and-control server to exfiltrate sensitive data, including banking credentials and cryptocurrency wallet keys, and can receive further instructions to update itself or erase traces. The malware's primary objective is financial theft, enabling attackers to drain victims' bank accounts and crypto wallets without their knowledge. Security researchers note that the malware's abuse of accessibility permissions is mitigated in Android 14, which requires explicit user approval for such access, but devices running Android 13 and earlier remain vulnerable.
Jun 29, 2026