Android Malware

uCreator Android Spyware Hooks Telegram and WeChat Inside Virtual Containers

• Malware

uCreator Android Spyware Hooks Telegram and WeChat Inside Virtual Containers

Do Son October 26, 2026 0

Researcher Ovi exposes uCreator Android spyware. The YingGai uCreator Android spyware platform uses VirtualApp and LSPatch to hijack 20 mobile apps.

GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

• Malware

GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

Do Son October 16, 2026 0

Cyble reveals the GhostX ecosystem where Android GhostBat RAT and the new GhostBat RAT variant use Ghost Overlay to steal PINs from 60 Indian apps.

Hirudo Android Banking Trojan Replaces Genuine Banking Apps With Patched Copies

• Malware

Hirudo Android Banking Trojan Replaces Genuine Banking Apps With Patched Copies

Do Son October 16, 2026 0

ThreatFabric uncovers the Hirudo banking trojan. The Android Hirudo banking trojan replaces real banking apps with patched copies to steal funds.

RemControl Android Banking Trojan Steals Bank PINs

• Malware

RemControl Android Banking Trojan Steals Bank PINs

Do Son September 28, 2026 0

Group-IB found the RemControl Android banking trojan, a new malware using AI phishing overlays and fake TVTap apps to steal banking PINs and credentials.

Mantax Otax Android Malware: Spyware Meets Ransomware

• Malware

Mantax Otax Android Malware: Spyware Meets Ransomware

Do Son September 17, 2026 0

Zimperium zLabs discovered Mantax Otax Android malware, a fierce Indonesian mobile ransomware integrating spyware to hijack, record, and extort victims.

Vwork Android Malware Clones Apps in Gigabud Attacks

• Malware

Vwork Android Malware Clones Apps in Gigabud Attacks

Do Son September 16, 2026 0

Group-IB uncovered how the Gigabud Vwork Android malware chain clones apps. Discover how Vwork Android malware evades bank detection.

StreamRat Banking Trojan Targets Spanish Android Users

• Malware

StreamRat Banking Trojan Targets Spanish Android Users

Do Son September 7, 2026 0

A StreamRat banking trojan campaign uses fake Meta TV-streaming ads to infect Android users. The StreamRat banking trojan enables full device takeover.

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally

• Malware

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally

Do Son August 31, 2026 0

The new ToxicPanda 2.0 banking Trojan attacks target hundreds of financial apps globally. Learn how this ToxicPanda 2.0 banking Trojan steals credentials.

Manic Android Malware Steals Data Without Active Internet

• Malware

Manic Android Malware Steals Data Without Active Internet

Do Son August 23, 2026 0

A new Manic Android malware campaign combines banking fraud and spyware, using a unique offline mesh relay to steal data even without internet access.

Android Head Unit Malware Recruits Vehicles into Botnet

• Malware

Android Head Unit Malware Recruits Vehicles into Botnet

Do Son August 21, 2026 0

Kaspersky exposed Android head unit malware turned into a botnet. Discover how this Android head unit malware botnet infects smart cars.

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins

• Malware

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins

Do Son July 17, 2026 0

The GoldPickaxe banking Trojan returns, stealing biometric data, SMS, and lock screens from Android users across Asia, Zimperium warns.

Glitch SPY Android RAT Spreads Through a Fake Polish Rental App

• Malware

Glitch SPY Android RAT Spreads Through a Fake Polish Rental App

Do Son July 3, 2026 0

New Glitch SPY Android RAT spreads via a fake rental app, abusing Accessibility to steal data and swap crypto wallet addresses.

Rokarolla Android Banking Trojan Steals Financial Data

• Malware

Rokarolla Android Banking Trojan Steals Financial Data

Do Son June 25, 2026 0

The Rokarolla Android banking trojan executes a complete device takeover. It targets 217 apps and steals credentials through fake overlays and keyloggers.

Sophisticated Android Banking Trojan Threat Evades Detection via High-Trust Lures

• Malware

Sophisticated Android Banking Trojan Threat Evades Detection via High-Trust Lures

Do Son June 1, 2026 0

A new Android banking trojan threat targets 180+ apps. Learn how credential harvesting overlays steal banking data.

Android Carrier Billing Fraud Campaign Exposed by zLabs

• Cybercriminals

Android Carrier Billing Fraud Campaign Exposed by zLabs

Do Son May 26, 2026 0

A sophisticated Android carrier billing fraud campaign hit users worldwide. Learn how fake apps trigger premium SMS abuse and how to stay safe.

TrickMo’s Stealthy Upgrade: Android Banking Malware is Pivoting to The Open Network

• Malware

TrickMo’s Stealthy Upgrade: Android Banking Malware is Pivoting to The Open Network

Do Son May 12, 2026 0

ThreatFabric uncovers TrickMo Variant C, a new Android banking trojan using the decentralized TON network to evade detection and turn phones into proxies.

The Tadashi Files: Inside the xlabs_v1 Botnet Targeting 4 Million Android Devices

• Malware

The Tadashi Files: Inside the xlabs_v1 Botnet Targeting 4 Million Android Devices

Do Son May 3, 2026 0

Hunt Intelligence dismantles xlabs_v1, a Mirai-derived botnet targeting 4M Android devices via port 5555. See how an exposed server leaked the entire toolkit.

More Than a Miner: The Evasive MiningDropper Framework Hijacking Android Worldwide

• Malware

More Than a Miner: The Evasive MiningDropper Framework Hijacking Android Worldwide

Do Son April 20, 2026 0

Cyble reveals MiningDropper, a modular Android threat delivering RATs and infostealers via multi-stage payloads. Protect your mobile devices now.

‘Keenadu’ Firmware Backdoor Hijacks Android from the Inside Out

• Malware

‘Keenadu’ Firmware Backdoor Hijacks Android from the Inside Out

Do Son March 24, 2026 0

Sophos uncovers Keenadu, a persistent Android firmware backdoor embedded in core libraries that gives attackers total control via the Zygote process.

Operation False Siren: The Weaponization of Israel’s Red Alert App for Geo-Fenced Espionage

• Cybercriminals

Operation False Siren: The Weaponization of Israel’s Red Alert App for Geo-Fenced Espionage

Do Son March 12, 2026 0

Discover how Operation False Siren weaponizes Israel's Red Alert app via smishing, deploying advanced Android spyware for geo-fenced mobile espionage.

APT-C-23 Weaponized Israel’s ‘Red Alert’ App for Mobile Espionage

• Cybercriminals

APT-C-23 Weaponized Israel’s ‘Red Alert’ App for Mobile Espionage

Do Son March 11, 2026 0

Acronis TRU uncovers a trojanized Red Alert rocket warning app targeting Israelis. Linked to APT-C-23, this Android malware steals data while alerting users.

The Silent Rhythm: How BeatBanker Malware Uses a Looping Audio File to Hijack Android Devices

• Malware

The Silent Rhythm: How BeatBanker Malware Uses a Looping Audio File to Hijack Android Devices

Do Son March 10, 2026 0

Kaspersky uncovers BeatBanker, an Android malware in Brazil using an audio loop to evade detection while mining crypto and stealing banking credentials.