Android Malware FvncBot, SeedSnatcher, and ClayRat Gain Stronger Data Theft Features

Cybersecurity researchers have disclosed details of two new Android malware families, FvncBot and SeedSnatcher, as an upgraded version of ClayRat has been spotted in the wild, according to Intel 471, CYFIRMA and Zimperium.

FvncBot masquerades as a security app by mBank and targets Polish-speaking mobile banking users, using features such as keylogging via accessibility services, web-injects, screen streaming and hidden virtual network computing to facilitate fraud, with a dropper that installs the embedded payload and prompts users to install a Google Play component to deploy the malware.

The operators have employed a session-based approach to bypass accessibility restrictions on devices running Android 13 and newer, and log events are sent to a remote naleymilva.it[.]com domain to track status, with a build identifier flag indicating Poland as the target. SeedSnatcher, distributed under the name Coin via Telegram, is designed to steal cryptocurrency wallet seed phrases, intercept SMS to capture 2FA codes, and exfiltrate device data, contacts and calls while displaying phishing overlays.

ClayRat’s latest version adds expanded accessibility abuses, unlocking, screen recording, notification harvesting and persistent overlays, and has been distributed across 25 phishing domains impersonating services such as YouTube.