Fake Banking Rewards, Telegram Delivery and Albiriox: Anatomy of an Android Malware Campaign

A malicious campaign impersonates an Italian banking brand through a fraudulent domain offering fake financial rewards to entice users to install a malicious Android application distributed via a Telegram bot outside official app stores. The initial APK functions as a dropper that installs a second-stage payload identified as Albiriox, an Android banking Remote Access Trojan. Albiriox exploits Android Accessibility services to perform overlay attacks, intercept SMS messages, steal credentials, and enable remote device control through a custom TCP-based command-and-control protocol using JSON messages framed with big-endian length prefixes on ports 5555 and 5552. Attribution to Albiriox is based on protocol similarities, behavioral patterns, and comparison with known samples. The campaign infrastructure relies on domain impersonation and social engineering with financial incentives to distribute the malware, primarily targeting users in Italy.

The malware enables attackers to intercept SMS messages, capture user credentials, perform overlay attacks to deceive users, and remotely control infected Android devices. This can lead to unauthorized access to banking accounts and financial theft. The use of Accessibility services abuse increases the stealth and control capabilities of the malware on compromised devices.

No official patch or remediation is available as this is a malware campaign rather than a software vulnerability. Users should avoid installing applications from unofficial sources, especially those distributed via social engineering or fraudulent domains. Organizations should educate users about phishing and brand impersonation tactics. Monitoring and blocking the identified malicious domains and hashes can help reduce exposure. Since the malware is distributed outside official app stores, restricting installation of apps from unknown sources on Android devices is recommended.