Security researchers at Hunt Intelligence have dismantled the operational blueprint of a new Mirai-derived botnet dubbed xlabs_v1. The discovery occurred in early April 2026 when an open directory…

The seemingly innocuous download of a mobile game could culminate in a smartphone being compromised by sophisticated spyware.

ThreatFabric uncovers TrickMo Variant C, a new Android banking trojan using the decentralized TON network to evade detection and turn phones into proxies.

A sophisticated Android carrier billing fraud campaign hit users worldwide. Learn how fake apps trigger premium SMS abuse and how to stay safe.

A new Android banking trojan threat targets 180+ apps. Learn how credential harvesting overlays steal banking data.

The Rokarolla Android banking trojan executes a complete device takeover. It targets 217 apps and steals credentials through fake overlays and keyloggers.

At a glance Malware family Glitch SPY (Android RAT and builder platform) Threat actor Unattributed; operator unidentified Targets People seeking rental properties in Poland; Polish speakers Delive…

At a glance Malware family GoldPickaxe (Android banking Trojan, GoldDigger suite) Threat actor GoldFactory (confirmed by Zimperium; Chinese-speaking crime group) Target / victims Mobile banking, e…

A single phone call with a fraudster can now result, within the same session, in a loan taken out in the victim’s name and unauthorized purchases charged to their bank card. Researchers at G…

A novel Android malware variant currently enables cybercriminals to hijack a victim’s smartphone. This hijacking occurs specifically while the user interacts with banking applications and cr…

At a Glance Malware family: StreamRat Threat actor: Suspected Spanish-speaking developer using Mirax infrastructure Target or victims: Spanish Android users (reached 570,000 Meta accounts) Deliver…

An Android feature devised to separate personal and corporate applications has become a hiding place for banking fraud. Group-IB has described the pairing of Gigabud and Vwork, which, in a confirm…

Android ransomware is no longer confined to locking files: Mantax Otax transforms an infected smartphone into a spying instrument and a channel of pressure on its owner at once. Zimperium has desc…

At a glance Malware family: Vwork and Gigabud Threat actor: GoldFactory (confirmed attribution) Targets or victims: Mobile banking users across 11 countries Delivery vector: Social engineering via…

Security researchers recently uncovered the Mantax Otax Android malware. This dangerous Indonesian mobile ransomware integrates deep espionage capabilities with aggressive file encryption. At a gl…

At a Glance Attribute Details Actor or Group Operator tracked as UNKK Activity Type Android banking malware, credential theft, remote device control Targets or Victims Retail banking customers in …

Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices.

At a Glance Malware Family Hirudo banking trojan (Android remote access trojan and app-patching toolkit) Threat Actor Unattributed financially motivated group (Chinese-language backend panel obser…

At a Glance Malware Family GhostBat RAT (operating within the GhostX operator ecosystem) Threat Actor Confirmed as the GhostX operator infrastructure; suspected Malware-as-a-Service (MaaS) model w…

At a Glance Malware Family uCreator Android spyware (branded by the vendor as YingGai and packaged under com.ucreator.*) Threat Actor Confirmed artifacts tied to three Changsha, Hunan companies (H…