MalwarePublished 3 Dec 2025

New Android malware lets criminals control your phone and drain your bank account

Source AlienVault OTX General

Description

Albiriox is a newly identified Android banking malware family that enables cybercriminals to remotely control infected devices and conduct financial fraud. It operates as Malware-as-a-Service (MaaS), featuring modular components such as loaders, command modules, and control panels designed specifically for targeting banking, fintech, payment, and cryptocurrency applications. Distributed via fake apps and social engineering, it mimics legitimate brands and app stores to deceive users. The malware abuses Android accessibility features and employs black-screen masking to hide malicious activity. Notably, it can bypass multi-factor authentication and device fingerprinting, increasing its effectiveness. Although currently rated medium severity, its capabilities pose significant risks to user confidentiality and financial integrity. European organizations with mobile banking users are at risk, especially in countries with high Android adoption and fintech usage. Mitigation requires verifying app sources, maintaining updated devices, deploying advanced anti-malware solutions, and educating users about social engineering tactics.

Impact

For European organizations, Albiriox poses a significant threat to mobile banking users and financial institutions relying on Android platforms. The malware’s capability to remotely control devices and bypass multi-factor authentication can lead to unauthorized transactions, financial theft, and loss of customer trust. Financial service providers may face increased fraud claims, regulatory scrutiny, and reputational damage. The black-screen masking technique complicates detection by end-users, potentially delaying incident response. Organizations with employees using Android devices for corporate banking or fintech applications risk data leakage and unauthorized access to sensitive financial information. The MaaS distribution model increases the scale and speed of infection, potentially affecting a broad user base across Europe. Additionally, the targeting of cryptocurrency apps introduces risks to digital asset security, which is increasingly relevant in European markets. The malware’s presence can also strain cybersecurity resources due to the complexity of detection and remediation. Overall, the threat could disrupt financial operations, increase fraud losses, and undermine confidence in mobile financial services within Europe.

Defensive guidance

To mitigate the risk posed by Albiriox, European organizations should implement a multi-layered defense strategy tailored to mobile financial security. First, enforce strict app installation policies that restrict users to official app stores and verified applications, employing mobile device management (MDM) solutions to control app permissions and installations. Deploy advanced mobile threat defense (MTD) solutions capable of detecting accessibility abuse and black-screen masking behaviors. Regularly update Android OS and financial applications to patch vulnerabilities that malware could exploit. Educate users on recognizing social engineering tactics and the dangers of installing apps from untrusted sources. Implement behavioral analytics to detect anomalous transaction patterns indicative of fraud. Financial institutions should enhance backend fraud detection systems to identify suspicious activities even if multi-factor authentication is bypassed. Encourage the use of hardware-backed security features such as Trusted Execution Environments (TEE) for sensitive operations. Conduct regular security audits and incident response drills focused on mobile threats. Finally, share threat intelligence and indicators of compromise (such as the provided malware hashes) with relevant cybersecurity communities and law enforcement to facilitate coordinated defense efforts.

Summary

Albiriox is an advanced Android banking malware family that has emerged as a potent threat to mobile financial security. It is offered as Malware-as-a-Service (MaaS), allowing cybercriminals to rent or purchase its capabilities for widespread attacks. The malware’s architecture is modular, comprising loaders that initiate infection, command modules that execute specific tasks, and control panels that allow operators to manage campaigns and monitor infected devices. Albiriox targets hundreds of banking, fintech, payment, and cryptocurrency applications across multiple regions, leveraging on-device fraud tools to manipulate transactions and steal credentials. It abuses Android’s accessibility services to gain elevated permissions, enabling remote control over the device. The malware uses black-screen masking techniques to conceal fraudulent activities from the user, effectively hiding unauthorized transactions or screen interactions. Distribution methods include fake applications and social engineering campaigns that impersonate legitimate brands or app stores, increasing the likelihood of user infection. Critically, Albiriox can bypass multi-factor authentication mechanisms and device fingerprinting checks, which are common defenses in financial apps, thereby undermining security controls designed to prevent unauthorized access. While no CVSS score is assigned, the malware’s ability to compromise confidentiality, integrity, and availability of financial data, combined with ease of exploitation via social engineering and no requirement for prior authentication, makes it a serious threat. Indicators of compromise include multiple known malware hashes. The malware is currently reported in Austria but is likely to spread given its MaaS model and targeting of widely used financial apps.

Indicators of compromise

Hashes 12

61b59eb41c0ae7fc94f800812860b22a
b6bae028ce6b0eff784de1c5e766ee33
f09b82182a5935a27566cdb570ce668f
f5b501e3d766f3024eb532893acc8c6c
1bf53adfede11f6857a95d7b74b40011ff201009
731a13bad6316fda68c9d57fb4e562dd0c1130ce
b0913e8cbff6a9623cf97a3d4d796ec259e24df7
bb2b152adbba554409746bf64d8df71d80a236ea
070640095c935c245f960e4e2e3e93720dd57465c81fa9c72426ee008c627bf3
5e14181839816bbb4b55badc91f29d382e8d6f603eec2ed8f8b731c35def6b59

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Dec 2025, 14:46 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

Indicators of compromise

Hashes 12

Community reviews

Related threats