New Sturnus Banking Trojan Targets WhatsApp, Telegram, Signal Messages

A new Android banking trojan named Sturnus is designed to target communications from secure messaging apps such as WhatsApp, Telegram and Signal, according to ThreatFabric. The malware is described as fully functional but still under development, with its activity focused on customers of financial institutions in Central and Southern Europe. Once installed, Sturnus can perform overlay attacks to display fake bank login screens, log keystrokes, and even remotely control the compromised device.

It also seeks administrator privileges and monitors user activity to detect attempts to remove it. A notable capability is that it targets foreground messaging apps; the malware reads everything that appears on screen—including contacts, full conversation threads, and the content of incoming and outgoing messages—in real time, effectively sidestepping end-to-end encryption after decryption by the legitimate app. According to ThreatFabric researchers, this combination makes the threat particularly dangerous.