Hackers Targeting 217 Android Finance Apps, Draining PINs, Patterns and Passwords: Zimperium

New Android Banking Trojan Rokarolla Targets 217 Banking and Cryptocurrency Apps

A new Android banking trojan, known as Rokarolla, is posing a serious threat by targeting 217 banking and cryptocurrency apps. This malware gives attackers extensive control over infected devices, allowing them to carry out various malicious activities.

Rokarolla is being distributed through malicious websites that disguise it as popular applications like TikTok and Google Chrome, as reported by mobile cybersecurity firm Zimperium. The trojan is designed to compromise financial and crypto applications by utilizing fake screens that overlay legitimate apps.

One of the alarming features of Rokarolla is its ability to steal device unlock credentials, including PINs, patterns, and passwords, by displaying a fake Android lock screen. The information entered into this fake screen is then transmitted to infrastructure controlled by the attackers.

Furthermore, the malware can also steal banking and cryptocurrency credentials when users access targeted financial apps. It can present a fake login page to capture sensitive information such as login credentials and credit card details.

Zimperium has identified 137 commands within Rokarolla that enable attackers to exert control over infected devices. These commands allow them to collect SMS messages, steal contact lists, record user input, and monitor screen activity. Additionally, the trojan can block incoming calls, mute device audio, and disable Google Play Protect.

Another concerning capability of Rokarolla is its ability to intercept SMS messages, send texts on behalf of victims, and prevent users from receiving fraud alerts from banks. The malware targets more than 200 financial, cryptocurrency, and social media applications, with a focus on 217 distinct cryptocurrency and banking apps.

Zimperium emphasizes that Rokarolla’s features are specifically designed to facilitate financial fraud and prevent victims from detecting and stopping malicious activities on their infected devices.

Stay informed about the latest cybersecurity threats by subscribing to our newsletter.

Generated Image: Midjourney