Banking Trojan Archives • Daily CyberSecurity

KREMLIN Banking Malware Targets Brazilian Banks Diagram of Brazilian KREMLIN banking malware showing how KREMLIN banking malware installs malicious browser extensions

Diagram of Brazilian KREMLIN banking malware showing how KREMLIN banking malware installs malicious browser extensions

KREMLIN Banking Malware Targets Brazilian Banks

Do Son September 21, 2026

At a Glance Attribute Details Malware Family KREMLIN (also tracked as CHROMEBALLRAT) Threat Actor REF9334 (alias Kr3mlin4rt1st;...

Vwork Android Malware Clones Apps in Gigabud Attacks Vwork Android malware diagram showing the Gigabud Vwork Android malware attack chain

Vwork Android Malware Clones Apps in Gigabud Attacks

Do Son September 16, 2026

At a glance Malware family: Vwork and Gigabud Threat actor: GoldFactory (confirmed attribution) Targets or victims: Mobile...

Casbaneiro Banking Trojan Hits Latin American Banks Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Casbaneiro Banking Trojan Hits Latin American Banks

Do Son September 16, 2026

At a glance Malware family: Casbaneiro Threat actor: Unknown Latin American cybercriminal group (suspected attribution) Targets or...

StreamRat Banking Trojan Targets Spanish Android Users StreamRat banking trojan campaign fake Meta advertisement targeting Android devices

StreamRat banking trojan campaign fake Meta advertisement targeting Android devices

StreamRat Banking Trojan Targets Spanish Android Users

Do Son September 7, 2026

At a Glance Malware family: StreamRat Threat actor: Suspected Spanish-speaking developer using Mirax infrastructure Target or victims:...

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally Diagram showing how the ToxicPanda 2.0 banking Trojan attacks victims using the updated ToxicPanda 2.0 banking Trojan

Diagram showing how the ToxicPanda 2.0 banking Trojan attacks victims using the updated ToxicPanda 2.0 banking Trojan

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally

Do Son August 31, 2026

At a glance Factor Details Malware Family ToxicPanda 2.0 Threat Actor Unconfirmed (Suspected Chinese-speaking actors) Targets Android...

Grandoreiro Banking Trojan Returns With a DLL Sideloading Campaign TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Grandoreiro Banking Trojan Returns With a DLL Sideloading Campaign

Do Son August 26, 2026

At a glance Malware family Grandoreiro banking trojan Threat actor Portuguese-speaking operators (suspected) Target or victims Bank...

Lampion Malware Campaign Targets Portugal With Fake Payment Receipts C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

Lampion Malware Campaign Targets Portugal With Fake Payment Receipts

Do Son July 29, 2026

At a Glance Malware family Lampion, a Brazilian banking trojan from the ChePro lineage Threat actor No...

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins

Do Son July 17, 2026

At a glance Malware family GoldPickaxe (Android banking Trojan, GoldDigger suite) Threat actor GoldFactory (confirmed by Zimperium;...

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram

Do Son July 15, 2026

Malware family RedWing (Android spyware/RAT; suspected new variant of Oblivion) Threat actor Unnamed operators; suspected Russian-nexus, not...

Ousaban Banking Trojan Targets Spain and Portugal Ousaban banking trojan infection chain diagram showing malware delivery methods.

Ousaban Banking Trojan Targets Spain and Portugal

Do Son July 6, 2026

At a glance: Malware Family: Ousaban Threat Actor: Unknown (Suspected Latin American origin) Targets/Victims: Banking customers in...

Rokarolla Android banking trojan executing a device takeover

Rokarolla Android Banking Trojan Steals Financial Data

Do Son June 25, 2026

At a Glance Malware Family: Rokarolla Android banking trojan Threat Actor: Unknown Targets or Victims: 217 cryptocurrency...

Grandoreiro Banking Trojan Evades Defense via Lookalike Software TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Grandoreiro Banking Trojan Evades Defense via Lookalike Software

Do Son June 2, 2026

A highly dangerous threat vector is actively menacing global financial networks. Specifically, the notorious Grandoreiro banking trojan...

In-Memory Financial Theft: Inside Banana RAT’s Operator-Driven Attacks on Brazilian Banks Banana RAT Banking Trojan SHADOW-WATER-063 MaaS

In-Memory Financial Theft: Inside Banana RAT’s Operator-Driven Attacks on Brazilian Banks

Do Son May 25, 2026

A sophisticated, highly focused banking trojan is actively undermining the security controls of financial institutions across South...

TrickMo’s Stealthy Upgrade: Android Banking Malware is Pivoting to The Open Network TrickMo banking trojan TON network malware

TrickMo’s Stealthy Upgrade: Android Banking Malware is Pivoting to The Open Network

Do Son May 12, 2026

Modern Android banking malware is undergoing a quiet, dangerous revolution. Rather than flashing new user-facing tricks, threat...

Self-Spreading TCLBANKER Trojan Hijacks WhatsApp to Drain Accounts TCLBANKER Trojan REF3076 Malware

Self-Spreading TCLBANKER Trojan Hijacks WhatsApp to Drain Accounts

Do Son May 8, 2026

Elastic Security Labs has uncovered a highly sophisticated Brazilian banking trojan dubbed TCLBANKER, tracked under the campaign...

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts JanelaRAT LATAM Banking Malware

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts

Do Son April 15, 2026

In the diverse ecosystem of Latin American cybercrime, one threat continues to refine its ability to peer...

Ghost in the Browser: Advanced ‘GoPix’ Trojan Unveils Unprecedented MitM Attacks GoPix Trojan Brazilian Banking Malware

Ghost in the Browser: Advanced ‘GoPix’ Trojan Unveils Unprecedented MitM Attacks

Do Son March 19, 2026

A sophisticated new threat has emerged from the Brazilian cybercrime underground, signaling a dangerous shift toward APT-level...

The Silent Rhythm: How BeatBanker Malware Uses a Looping Audio File to Hijack Android Devices BeatBanker Android Malware

The Silent Rhythm: How BeatBanker Malware Uses a Looping Audio File to Hijack Android Devices

Do Son March 10, 2026

In a sophisticated new campaign targeting users in Brazil, researchers at Kaspersky Labs have uncovered BeatBanker, an...

AI Hub Hijacked: Polymorphic Android RAT Abuses Hugging Face to Steal Data BadBox 2.0, Android Botnet Alien spyware - CVE-2024-43093

AI Hub Hijacked: Polymorphic Android RAT Abuses Hugging Face to Steal Data

Do Son February 4, 2026

In a troubling convergence of trusted developer infrastructure and cybercrime, Bitdefender researchers have uncovered a sophisticated Android...

Spy, Steal, Lock: deVixor Android Trojan Hits Banking & Crypto Users deVixor Malware Android Banking Trojan

Spy, Steal, Lock: deVixor Android Trojan Hits Banking & Crypto Users

Do Son January 14, 2026

A sophisticated new threat has emerged in the mobile banking landscape, combining the stealth of a spy...

“Boto Cor-de-Rosa”: Banking Malware Astaroth Pivots to WhatsApp in New Campaign NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

“Boto Cor-de-Rosa”: Banking Malware Astaroth Pivots to WhatsApp in New Campaign

Do Son January 12, 2026

The notorious Brazilian banking malware Astaroth has evolved again, this time turning one of the world’s most...

Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts

Do Son December 23, 2025

A sophisticated wave of mobile malware is sweeping through Central Asia, marking a dangerous evolution in how...

Critical Alert 1 Active Exploit Detected Today