Mirax Android RAT steals bank logins through streaming-app ads
Group-IB says thousands of phones in the Middle East, Turkey and Africa were infected from March to September 2026, with losses in the millions.
Stories per day · 30 days
5 RSS
Relatedandroid11hirudo6play-integrity5threatfabric5accessibility4credential-theft4india4indonesia4mobile-malware3android-malware2cryptomining2cyberdakait2mirax2accessibility-abuse1call-forwarding1darksword1fake-update1ghostbat1
55 stories, newest first · one card per story
Stories tagged #banking-trojan
Kaspersky: mobile attacks fell in Q3 as banking Trojans led
Blocked attacks fell to 1,668,368, while 378,456 malicious packages included 119,688 mobile banking Trojans.
MR ROBOT Android MaaS rents bank trojans aimed at Indian customers
CloudSEK says one affiliate’s data held 5,407 texts from 153 devices, with call forwarding on 58 percent.
1
Banking trojans infect 17,960 Android phones in India
Group-IB says seven families intercepted 7,611,443 SMS messages and stole cards, OTPs, and identity data.
1
CyberDakait malware hits 17,960 Indian banking Android devices
Operators intercepted 7,611,443 SMS messages and paired credential theft with XMRig mining on idle phones.
2
Hirudo Android trojan swaps real banking apps for hooked copies
ThreatFabric says replacements are ready for eight Indonesian bank apps and that August 2026 backend data held thousands of credential entries.
6
Hirudo Android RAT swaps banking apps using fake updates
ThreatFabric says lure apps drop Hirudo, which can uninstall genuine Indonesian bank apps and install modified copies that spoof integrity checks.
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
ThreatFabric details Hirudo, an Android banking RAT that swaps Indonesian bank apps for trojanized copies.
The GhostX Ecosystem: Forged in Transit, Licensed to Deceive
GhostBat RAT, part of the GhostX ecosystem, steals banking PINs from Android users in India via smishing and overlays.
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Hirudo uninstalls real Android banking apps and installs patched copies to steal credentials and bypass security checks.
11
Hirudo Android malware replaces banking apps to evade security checks
Hirudo Android malware replaces banking apps with hooked copies that steal credentials and bypass integrity checks.
3
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Hirudo Android trojan replaces Indonesian banking apps with patched copies to steal credentials and control devices.
8
Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
Casbaneiro hides its main command channel until Latin American victims open targeted banking sites.
2
Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
Casbaneiro banking trojan phishes Latin American users and starts banking C2 only after victims open targeted bank sites.
2
Malicious PDF Reader With 10,000+ Installs on Google Play Delivers Anatsa Banking Trojan
Zscaler found a fake Android PDF reader with 10,000+ Google Play installs acting as dropper for the Anatsa banking trojan, with full IOCs published.
RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions
RATHat Android banking trojan uses Gemini to pair wireless debugging and control phones beyond normal app permissions.
Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks
Cleafy's RATHat Android trojan uses Gemini Flash to navigate UIs and keeps shell persistence after app removal.
1
RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model
Cleafy details RatHat Android banking trojan's C2 panel evolving into a Gemini-powered malware-as-a-service platform that ranks victims by estimated bank balance.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Cleafy details RatHat Android banking trojan's malware-as-a-service console, which uses Google Gemini to rank victims by bank balance and guide on-device taps.
RemControl Banking Trojan Gives Attackers Remote Control of Android Devices
RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.
3
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.
3
New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs
RemControl, a new Android banking trojan, uses fake streaming-app downloads and overlays to steal banking PINs.
1
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
4
RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.
3