Android Hackers Target 800 Banking, Crypto and Social Media Apps With ‘Near-Zero Detection Rates’: Zimperium

Android hackers are now targeting more than 800 applications across banking, cryptocurrency and social media sectors.

The cybersecurity firm Zimperium says its researchers have identified four active malware families that use advanced command-and-control infrastructure to steal credentials, conduct unauthorized financial transactions and exfiltrate data at scale.

“Collectively, these campaigns target over 800 applications across the banking, cryptocurrency, and social media sectors.

By employing advanced anti-analysis techniques and structural APK tampering, these families often maintain near-zero detection rates against traditional signature-based security mechanisms.”

The names of the malware families are RecruitRat, SaferRat, Astrinox and Massiv.

Attackers commonly rely on phishing websites, fraudulent job offers, fake software updates, text-message scams and promotional lures to convince victims to install malicious Android apps.

Once installed, the malware can request Accessibility permissions, hide app icons, block uninstall attempts, steal PINs and passwords through fake lock screens, capture one-time passcodes, stream live device screens and overlay counterfeit login pages on legitimate banking or crypto apps.

“Overlay attacks remain the cornerstone of the credential-harvesting lifecycle. Using Accessibility Services to monitor the foreground, the malware detects the exact moment a victim launches a financial application. The malware then fetches a malicious HTML payload and overlays it onto the legitimate application’s user interface, creating a highly convincing, deceptive facade.”

The company said the campaigns use HTTPS and WebSocket communications to blend malicious traffic with normal app activity, while some variants add extra encryption layers to evade detection.

Generated Image: Midjourney