Senior Travel Scams Used by Threat Actors to Distribute Datzbro Malware

In August 2025, Australian authorities issued multiple scam alerts after users reported suspicious Facebook groups promoting “active senior trips.” The campaign, which initially appeared as harmless community gatherings, was a sophisticated mobile malware operation, with ThreatFabric researchers uncovering that groups were managed by fraudsters luring seniors into downloading a malicious Android Trojan dubbed “Datzbro.” The campaign targeted seniors seeking social activities, with groups across Australia, Singapore, Malaysia, Canada, South Africa and the United Kingdom using AI-generated posts about dances, day trips and events; victims were contacted via Facebook Messenger or WhatsApp and invited to download a “community application” for event registration and scheduling.

Android victims who clicked the Google Play button were served a malicious APK, leading to a Device-Takeover Trojan capable of spyware and remote-control functions, including remote screen sharing, overlay concealment, and device locking, enabled via Android Accessibility Services, per ThreatFabric’s Mobile Threat Intelligence team.

Datzbro also contains filters for banking and crypto apps to prompt fake credential entry and intercept authentication data, with a leaked desktop C2 interface and builder now available on public virus-sharing platforms, suggesting roots in Chinese-speaking cybercriminal communities.