StreamRat is an Android banking trojan distributed via Meta and TikTok ads disguised as a free TV-streaming app targeting Spanish-speaking users, mainly in Spain. It uses a two-stage installation with a dropper that disables internet connectivity through fake VPN connections. After installation, it abuses Accessibility Services and the MediaProjection API to grant attackers near-complete control over the device, including VNC remote control, hidden screen manipulation, keylogging, credential-stealing overlays, UI data collection, and screen blocking. The malware operates as a Malware-as-a-Service with a multi-role control panel and WebSocket-based command and control communications. The campaign potentially affected around 570,000 users. No official patch or remediation guidance is currently available.
GoldDigger is a sophisticated Android banking trojan that primarily targets mobile banking users in South Africa and across Europe, with evidence suggesting plans for global expansion. The malware employs advanced evasion techniques including a custom packer called 'dpt-shell', anti-debugging mechanisms, and Frida detection. It disguises itself as legitimate airline and shopping applications to deceive victims. GoldDigger exploits Android Accessibility services to perform on-device fraud, steal credentials, intercept SMS-based two-factor authentication, and execute unauthorized transactions. A unique feature is its ability to run targeted banking applications in a virtual environment, allowing complete interception of API calls and runtime behavior. The malware maintains communication with command-and-control servers via encrypted WebSocket protocol, enabling capabilities including screen recording, audio capture, phishing overlays, and remote device manipulation.
A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.
