OverlayPhantom Android Trojan Targets 180+ Banking and Crypto Apps
Researchers identified OverlayPhantom, a previously undocumented Android banking trojan distributed through malicious URLs that impersonate trusted apps including Austria’s ID Austria and TikTok. The malware uses a two-stage infection chain: a dropper installs a payload disguised as Google Play Services, then abuses Android Accessibility Service to gain persistent control of the device. Investigators said the campaign has been active since early May 2025 and is aimed at large-scale financial fraud across Western markets.
OverlayPhantom targets more than 180 banking, financial, and cryptocurrency applications across 10 countries, using embedded HTML overlay phishing pages to steal credentials and payment data. The malware also leverages Android’s MediaProjection API for near-real-time JPEG screen streaming and supports more than 30 remote commands, including gesture simulation, clipboard manipulation, fake notifications, device locking, and PIN or password capture. Its command-and-control infrastructure was tied to 199.217[.]99[.]122, using non-standard ports 9091, 9092, and 9090 for command execution, device reporting, and screen streaming.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
OverlayPhantom banking trojan campaign becomes active
Cyble said the previously undocumented Android banking trojan OverlayPhantom has been active since early May 2025 and distributed through malicious URLs impersonating trusted applications. The campaign uses a two-stage infection chain with a dropper and a payload posing as Google Play Services.
Cyble identifies and documents OverlayPhantom
Cyble Research and Intelligence Labs identified and publicly documented OverlayPhantom as a previously undocumented Android banking trojan. The report described targeting of more than 180 banking, financial, and cryptocurrency apps across 10 countries, along with its C2 infrastructure and remote-control capabilities.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
5 references tracked. Mallory keeps watching after this page renders.
Android Banking Trojan OverlayPhantom Abuses Accessibility Service to Control Devices
cybersecuritynews.com
Open sourceAndroid Banking Trojan Threat: OverlayPhantom Found
securityonline.info
Open sourceOverlayPhantom: The Android Banking Trojan Hiding in Plain Sight | Community Portal | Gurucul
community.gurucul.com
Open sourceOverlayPhantom: The Android Banking Trojan Hiding in Plain Sight - Malware News - Malware Analysis, News and Indicators
malware.news
Open sourceOverlayPhantom-android-banking-trojan-hiding In Plain Sight
cyble.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Four Android Banking Trojans Target 800+ Apps With MFA-Bypassing Overlays
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Apr 20, 2026
Rokarolla Android Trojan Targets 217 Banking and Crypto Apps
Zimperium’s zLabs has identified a new Android banking trojan, **Rokarolla**, that targets **217 banking and cryptocurrency applications** and gives attackers broad control over infected devices through **137 remote commands**. The malware is distributed via malicious websites impersonating popular apps such as TikTok and Chrome, then installs a secondary dropper disguised as **Google Play Protect** to obtain Accessibility permissions and deploy the payload. Researchers said Rokarolla steals credentials with fake overlays and phishing pages placed over legitimate financial apps and even the device lock screen, enabling theft of usernames, passwords, PINs, and SMS one-time codes. Beyond financial theft, Rokarolla supports deep surveillance and device manipulation, including keylogging, screenshot and screen-log capture, contact and notification scraping, WhatsApp data theft, call suppression, sound muting, clipboard hijacking to reroute cryptocurrency transfers, and disabling Google Play Protect scans. Zimperium said the malware also uses multiple fallback command-and-control domains and a **Pseudo-VNC** capability to maintain resilient access and monitor victims in near real time, underscoring how Android banking trojans are evolving from credential theft into full device takeover that can bypass multi-factor authentication protections.
Jun 18, 2026
Android Banking Trojans Spread via Fake Document Reader and KYC Apps
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Apr 29, 2026