MalwarePublished 17 Jun 2026

New Rokarolla Android Trojan Targets 217 Banking and Crypto Apps

Source Reddit Cybersecurity

Discussion

Rokarolla is a new Android banking Trojan targeting 217 banking and cryptocurrency apps. It spreads via malicious websites masquerading as popular apps like TikTok and Chrome, initially installing a dropper disguised as Google Play Protect. Once installed and granted Accessibility Services, it can simulate user actions, inject overlays, intercept credentials, block calls, read and send SMS, disable Google Play Protect, and silently capture screen content. The malware dynamically downloads fake login pages to steal credentials and can operate even when the device is locked. It also replaces copied cryptocurrency wallet addresses with attacker-controlled ones and suppresses audio and notifications to avoid user detection. Rokarolla uses resilient command-and-control infrastructure and employs stealth techniques to maintain persistence and evade detection. No software flaw is exploited, so no patch is available; mitigation relies on user caution and security products detecting the malware.

r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments

https://securityaffairs.com/193745/cyber-crime/new-rokarolla-android-trojan-targets-217-banking-and-crypto-apps.html

Links cited in the discussion

https://securityaffairs.com/193745/cyber-crime/new-rokarolla-android-trojan-targets-217-banking-and-crypto-apps.html

Impact

The malware compromises user credentials for 217 banking and cryptocurrency apps, enabling attackers to steal login information, card numbers, and intercept one-time passwords via SMS. It can block incoming calls silently, preventing fraud alerts from reaching the user, and suppress device audio to hide notifications. Rokarolla can operate even when the device is locked, allowing attackers to execute commands remotely. Clipboard manipulation enables theft of cryptocurrency by replacing wallet addresses. The malware’s stealth and persistence techniques make detection and removal difficult, increasing the risk of financial theft and unauthorized access to sensitive accounts.

Defensive guidance

Users should only install apps from trusted sources such as Google Play Store. Accessibility Services should only be granted to known and trusted assistive applications. Any app requesting default SMS or call handler status should be treated as suspicious and denied such permissions. Security products like Zimperium’s Mobile Threat Defense and zDefend detect Rokarolla; deploying such solutions can help identify and block this malware. Users should remain vigilant for unusual device behavior and avoid clicking links from untrusted websites.

Summary

Rokarolla is an Android banking Trojan that targets 217 distinct banking and cryptocurrency applications by stealing credentials, intercepting SMS messages, blocking incoming calls, and disabling Google Play Protect. It spreads through malicious websites posing as popular apps and installs a dropper disguised as Google Play Protect to avoid suspicion. After obtaining Accessibility Services, Rokarolla can simulate user interactions, inject fraudulent overlays, capture keystrokes and screen content via snapshots, and exfiltrate sensitive data. It dynamically downloads fake login pages from its command-and-control server to capture credentials and can operate even when the device is locked by deploying fake lock screens. The malware also silently rewrites clipboard data to redirect cryptocurrency transactions and suppresses device audio and vibrations to avoid alerting the user. Its command-and-control infrastructure is resilient with multiple fallback domains.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 17 Jun 2026, 12:45 UTC

Technical details

References

Community reviews

Related threats