Threats Tagged 'trojan'

Rokarolla is a new Android banking Trojan targeting 217 banking and cryptocurrency apps. It spreads via malicious websites masquerading as popular apps like TikTok and Chrome, initially installing a dropper disguised as Google Play Protect. Once installed and granted Accessibility Services, it can simulate user actions, inject overlays, intercept credentials, block calls, read and send SMS, disable Google Play Protect, and silently capture screen content. The malware dynamically downloads fake login pages to steal credentials and can operate even when the device is locked. It also replaces copied cryptocurrency wallet addresses with attacker-controlled ones and suppresses audio and notifications to avoid user detection. Rokarolla uses resilient command-and-control infrastructure and employs stealth techniques to maintain persistence and evade detection. No software flaw is exploited, so no patch is available; mitigation relies on user caution and security products detecting the malware.

A user reported finding a trojan named "Servicehost.exe" on their PC, detected by Malwarebytes and identified via VirusTotal. The user is concerned that this malware may have recorded or leaked private calls. The report is based on a Reddit post linking to VirusTotal scan results, but no detailed technical or vendor advisory information is available. There is no confirmation of active exploitation or specific capabilities beyond the user's concern and VirusTotal detections.