GoldDigger is an Android banking trojan that targets mobile banking users mainly in South Africa and Europe. It employs advanced evasion methods including a custom packer named 'dpt-shell', anti-debugging techniques, and detection of Frida instrumentation. The malware masquerades as legitimate airline and shopping applications to trick users. It exploits Android Accessibility services to conduct on-device fraud, steal user credentials, intercept SMS-based two-factor authentication codes, and execute unauthorized financial transactions. A unique feature is its ability to run banking applications inside a virtual environment, allowing it to fully intercept API calls and monitor runtime behavior. GoldDigger maintains encrypted WebSocket communications with its command-and-control servers, which facilitates capabilities such as screen recording, audio capture, phishing overlays, and remote manipulation of the infected device.

The malware enables attackers to steal banking credentials, bypass SMS-based two-factor authentication, and perform unauthorized transactions on infected devices. Its use of Accessibility services and virtual environments increases the stealth and effectiveness of attacks. The encrypted communication channel allows persistent remote control, including screen and audio capture and phishing overlays, which can lead to significant financial fraud and privacy breaches for victims.

No official patch or remediation is available as this is malware targeting Android devices. Mitigation focuses on user awareness to avoid installing apps from untrusted sources, especially those masquerading as legitimate airline or shopping applications. Mobile security solutions with behavior-based detection may help identify and block this malware. Monitoring for suspicious Accessibility service usage and restricting app permissions can reduce risk. Users in affected regions, particularly South Africa and Europe, should exercise heightened caution.