SecuriTricks - banking

Fantasy Hub: Another Russian Based RAT as Malware-as-a-Service

A new Android Remote Access Trojan called Fantasy Hub has been identified, sold on Russian-language channels as a Malware-as-a-Service (MaaS) subscription. The malware offers extensive device control and espionage capabilities, including SMS exfiltration, contact theft, call log access, and bulk im…

rat

android

Published: November 10, 2025

Downloadable IOCs: 169

Technical Analysis of Zloader Updates

Recent versions of Zloader, a Zeus-based modular trojan, have introduced significant enhancements to its functionality. These updates include improved obfuscation techniques, anti-analysis strategies, and network communication methods. The malware now supports WebSockets and has modified its DNS tu…

Published: September 22, 2025

Downloadable IOCs: 0

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT

A large-scale Malware-as-a-Service operation, orchestrated by Chinese-speaking threat actors, has infected over 11,000 Android devices globally with the PlayPraetor Remote Access Trojan. The campaign primarily targets Europe, with significant presence in Portugal, Spain, and France, but also affect…

accessibility services

2025-08-07

playpraetor

Published: August 7, 2025

Downloadable IOCs: 0

Android Malware Posing As Indian Bank Apps

This report analyzes a sophisticated Android malware targeting Indian banking apps. The malware uses a dropper and main payload structure, leveraging permissions like SMS access and silent installation to steal credentials, intercept messages, and perform unauthorized financial activities. It emplo…

Published: July 25, 2025

Downloadable IOCs: 2

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices

A new Android malware campaign has been discovered, disguising itself as a banking app to covertly mine cryptocurrency on locked devices. The malware, distributed through a phishing website impersonating Axis Bank, downloads and executes a modified version of XMRig, a popular cryptocurrency mining …

Published: July 18, 2025

Downloadable IOCs: 1

Operation Phantom Enigma

A malicious campaign targeting primarily Brazilian residents has been discovered, with attacks detected since early 2025. The attackers employed phishing emails, some sent from compromised company servers, to distribute malware. Two attack chains were identified: one using a malicious browser exten…

Published: June 5, 2025

Downloadable IOCs: 0

SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation

A new Android malware campaign called 'SuperCard X' has been identified, employing NFC-relay techniques to enable fraudulent POS payments and ATM withdrawals. Distributed through a Chinese-speaking Malware-as-a-Service platform, it shares similarities with NGate malware. The campaign uses social en…

Published: April 18, 2025

Downloadable IOCs: 6

Smishing Triad: Chinese eCrime Group Targets 121+ Countries, Introduces New Banking Phishing Kit

The Chinese eCrime group Smishing Triad has launched a global SMS phishing campaign targeting over 121 countries across various industries. Their infrastructure generates over one million page visits in 20 days, averaging 50,000 daily. The group has introduced a new 'Lighthouse' phishing kit focusi…

chinese threat actors

2025-04-10

ecrime

global campaign

Published: April 10, 2025

Downloadable IOCs: 93

SmokeLoader Malware Targets Ukraine's Auto & Banking Sectors via Open Directories

An investigation uncovered open directories hosting SmokeLoader malware samples and lure documents targeting Ukraine's automotive and banking sectors. Two servers were identified, containing Windows executables and PDF files posing as invoices from Ukrainian companies. The malware injects into expl…

Published: February 7, 2025

Downloadable IOCs: 27

Phishing for Banking Information

A recent phishing campaign targeting Bank of Montreal (BMO) customers has been identified. The scam involves text messages purporting to be from BMO, asking recipients to verify their credit card information. Key indicators of the fraudulent nature include the use of a non-official SMS number, inco…

Published: December 27, 2024

Downloadable IOCs: 2

Hive0147 serving juicy Picanha with a side of Mekotio

IBM X-Force observed Hive0147, a highly active threat group in Latin America, distributing a new Golang-based downloader named Picanha to deploy the Mekotio banking trojan. Picanha is a two-stage malware that uses advanced techniques like direct syscalls and supports multiple download URLs, reliabl…

Published: October 17, 2024

Downloadable IOCs: 20

Hidden in Plain Sight: ErrorFather’s Deadly Deployment of Cerberus

This report examines a campaign called 'ErrorFather' that utilizes an undetected variant of the Cerberus Android Banking Trojan. The campaign employed a sophisticated multi-stage dropper technique to deploy the malicious payload, which incorporated features like keylogging, overlay attacks, VNC, an…

Published: October 15, 2024

Downloadable IOCs: 20

Uncovering ICICI Phishing Campaign: New Fraud App Found

A malicious host mimicking ICICI Bank has been discovered, along with a fraudulent app disguised as ICICI Helpdesk. The phishing domain, cppcccare.com, is hosted on an ASN known for various malicious activities. The fraudulent app, named 'ICICI.apk', is detected as a Trojan Banker, Keylogger, and S…

Published: September 24, 2024

Downloadable IOCs: 3

NGate Android malware relays NFC traffic to steal cash

ESET researchers uncovered a crimeware campaign targeting bank customers in Czechia. The NGate Android malware can relay NFC data from victims' payment cards to attackers' devices, enabling unauthorized ATM withdrawals. It's the first time this capability has been observed in the wild. The campaign…

Published: August 22, 2024

Downloadable IOCs: 12

Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure

CloudSEK's threat research team uncovered a ransomware attack impacting banks and payment providers in India. The attack, initiated through a compromised Jenkins server at Brontoo Technology Solutions, is attributed to the RansomEXX ransomware group. This sophisticated threat actor employs tactics …

Published: August 20, 2024

Linked vulnerabilities : CVE-2024-23897

Downloadable IOCs: 18

BlankBot: A new Android banking trojan

A new Android banking trojan called BlankBot has been discovered. Discovered by Intel 471 researchers in July 2024, BlankBot primarily targets Turkish users through impersonated utility apps. With a range of malicious capabilities like customer injections, keylogging, screen recording, and remote c…

Published: August 6, 2024

Downloadable IOCs: 0

BingoMod: The new android RAT that steals money and wipes data

In late May 2024, a new Android Remote Access Trojan (RAT) named BingoMod emerged, aiming to initiate fraudulent money transfers from compromised devices using a technique called On-Device Fraud (ODF). After installation, BingoMod steals sensitive information, conducts overlay attacks, and provides…

Published: August 2, 2024

Downloadable IOCs: 3

GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

Group-IB discovered a Spanish-speaking criminal group, GXC Team, offering a sophisticated AI-powered phishing-as-a-service platform targeting Spanish bank customers. The group specialized in developing phishing kits, Android malware, and AI-powered scam tools. Their malicious Android app, disguised…

Published: July 29, 2024

Downloadable IOCs: 161

Cybercriminals attack banking customers in EU with V3B phishing kit

An analysis reveals that a cybercriminal group is distributing sophisticated phishing kits to target banking customers in the European Union. These kits, designed to steal sensitive information like credentials and OTP codes, utilize social engineering tactics to deceive victims into revealing pers…

Published: June 10, 2024

Downloadable IOCs: 44

New banking trojan “CarnavalHeist” targets Brazil with overlay attacks

Cisco Talos has been observing an active campaign targeting Brazilian users with a new banking trojan dubbed 'CarnavalHeist'. The malware employs common tactics like financial-themed spam emails, Delphi-based DLLs, overlay attacks, and input capture techniques like keylogging and screen capture. Ho…

Published: May 31, 2024

Downloadable IOCs: 61

AllaSenha: AllaKore variant leverages Azure cloud C2 to steal banking details in Latin America

Earlier in May, a security product detected a malicious payload aimed at stealing credentials required to access Brazilian bank accounts. The payload, named AllaSenha, is a variant of the infamous AllaKore RAT, leveraging Azure cloud infrastructure for command and control. It is specifically design…

Published: May 31, 2024

Downloadable IOCs: 61

Banking trojan unleashed: Observing emerging global campaigns

IBM's X-Force has been tracking large-scale phishing campaigns distributing the Grandoreiro banking trojan, likely operated as a Malware-as-a-Service. The malware targets over 1500 global banks, enabling banking fraud in over 60 countries. The latest variant features major updates, including string…

Published: May 20, 2024

Downloadable IOCs: 18

Tag: banking

Attack reports

Fantasy Hub: Another Russian Based RAT as Malware-as-a-Service

Technical Analysis of Zloader Updates

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT

Android Malware Posing As Indian Bank Apps

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices

Operation Phantom Enigma

SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation

Smishing Triad: Chinese eCrime Group Targets 121+ Countries, Introduces New Banking Phishing Kit

Analysis of New Mobile Banking Malware

Analysis: SmokeLoader malware distribution

FinStealer

SmokeLoader Malware Targets Ukraine's Auto & Banking Sectors via Open Directories

Phishing for Banking Information

Hive0147 serving juicy Picanha with a side of Mekotio

Hidden in Plain Sight: ErrorFather’s Deadly Deployment of Cerberus

Uncovering ICICI Phishing Campaign: New Fraud App Found

NGate Android malware relays NFC traffic to steal cash

Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure

BlankBot: A new Android banking trojan

BingoMod: The new android RAT that steals money and wipes data

GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

Cybercriminals attack banking customers in EU with V3B phishing kit

New banking trojan “CarnavalHeist” targets Brazil with overlay attacks

AllaSenha: AllaKore variant leverages Azure cloud C2 to steal banking details in Latin America

Banking trojan unleashed: Observing emerging global campaigns