Group-IB detailed a new version of the RedHook Android banking trojan that gains shell-level control of a phone by abusing the operating system's own wireless debugging feature, with no computer or root needed. Once a user is tricked into granting Accessibility permissions, the malware silently taps through Settings to enable Developer Options and Wireless Debugging, then pairs over the loopback interface to run privileged commands. From there it can silently install or remove apps, change secure settings, log keystrokes, stream the screen, and steal credentials, while an aggressive persistence stack keeps it running through reboots. It spreads through social engineering, with attackers impersonating government or bank staff.
Zimperium's zLabs has documented Rokarolla, a new Android banking trojan that targets 217 banking and cryptocurrency apps and accepts 137 remote commands, giving an operator near-total control of an infected phone. It lifts lock-screen PINs, reads and sends text messages to grab one-time codes, rewrites the clipboard to redirect cryptocurrency payments, and disables Google Play Protect. It spreads through malicious websites posing as popular apps like TikTok and Chrome, starting with a dropper disguised as Google Play Protect that abuses Accessibility permissions. The actual theft uses fake login overlays placed on top of real banking apps, and surveillance relies on quiet Accessibility screenshots.
TrustStrike Labs