Rokarolla is an Android banking Trojan that targets 217 distinct banking and cryptocurrency applications by stealing credentials, intercepting SMS messages, blocking incoming calls, and disabling Google Play Protect. It spreads through malicious websites posing as popular apps and installs a dropper disguised as Google Play Protect to avoid suspicion. After obtaining Accessibility Services, Rokarolla can simulate user interactions, inject fraudulent overlays, capture keystrokes and screen content via snapshots, and exfiltrate sensitive data. It dynamically downloads fake login pages from its command-and-control server to capture credentials and can operate even when the device is locked by deploying fake lock screens. The malware also silently rewrites clipboard data to redirect cryptocurrency transactions and suppresses device audio and vibrations to avoid alerting the user. Its command-and-control infrastructure is resilient with multiple fallback domains. No underlying product vulnerability is exploited, so no patch exists; mitigation depends on avoiding installation from untrusted sources and restricting Accessibility Services permissions.

The malware compromises user credentials for 217 banking and cryptocurrency apps, enabling attackers to steal login information, card numbers, and intercept one-time passwords via SMS. It can block incoming calls silently, preventing fraud alerts from reaching the user, and suppress device audio to hide notifications. Rokarolla can operate even when the device is locked, allowing attackers to execute commands remotely. Clipboard manipulation enables theft of cryptocurrency by replacing wallet addresses. The malware’s stealth and persistence techniques make detection and removal difficult, increasing the risk of financial theft and unauthorized access to sensitive accounts.

No official patch or fix exists because Rokarolla exploits no software vulnerability. Users should only install apps from trusted sources such as Google Play Store. Accessibility Services should only be granted to known and trusted assistive applications. Any app requesting default SMS or call handler status should be treated as suspicious and denied such permissions. Security products like Zimperium’s Mobile Threat Defense and zDefend detect Rokarolla; deploying such solutions can help identify and block this malware. Users should remain vigilant for unusual device behavior and avoid clicking links from untrusted websites.