Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps

Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. The operators use elaborate download mechanisms, including a WebSocket-based delivery that streams the .apk in multiple chunks and simulates a native download process to bypass scanners, then automatically triggers the device download prompt.

The campaign also employs template-based spoofed sites mimicking regional apps, producing dozens of APKs such as BCA.apk, Livin.apk, and OCBCmobileid_02202025AC.apk, each configured to contact C2 domains like saping.ynhqhu[.]com and admin.congdichvucongdancuquocgia[.]cc, with the payload identified as a variant of BankBot[.]Remo and linked to a leaked 2016 source code.

Researchers noted more than 100 related domains, a shared infrastructure across Singapore and Indonesia, and a pattern of Alibaba ISP and Gname registrar usage, with DNS and TLS artefacts hinting at a regional focus on Indonesian and Vietnamese victims. The report highlights that end users should verify official app sources and that modern browsers’ download warnings remain a critical detection aid.