Malwarebytes
Rokarolla malware steals bank, crypto logins via fake overlays
Part of the Rokarolla story · since 16 Jun
- Tue 16 Jun, 13:19 UTC. Infosecurity, first report. Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts.
- Tue 16 Jun, 14:27 UTC. The Hacker News, its first report on the story. Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds.
- Tue 16 Jun, 18:25 UTC. Dark Reading, its first report on the story. Rokarolla Android Trojan steals data, spies via fake apps.
- Wed 17 Jun, 11:50 UTC. Security Affairs, its first report on the story. Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps.
- Wed 17 Jun, 16:10 UTC. Malwarebytes, its first report on the story. Rokarolla malware steals bank, crypto logins via fake overlays. This article, 5th of 7.
- Thu 18 Jun, 11:07 UTC. SecurityWeek, its first report on the story. Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock.
- Thu 25 Jun, 07:10 UTC. SecurityOnline, its first report on the story. Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data.
The article discusses a new Android malware named Rokarolla, which can completely take over devices and steal sensitive banking and cryptocurrency login details from over 200 apps. It uses deceptive overlay screens to capture user information, including PINs and passwords, and exploits Android's Accessibility features to monitor activity, intercept SMS, and manipulate phone functions.
Rokarolla is typically distributed via rogue websites posing as legitimate app downloads, tricking users into granting extensive permissions. To protect against such threats, users are advised not to trust apps claiming to be system components, avoid sideloading apps, and be cautious with permissions.
How the story developed
7 articles from 7 outlets since 16 Jun. Quiet since 25 Jun. This was the 5th report, 1 day after the first.
- Tue 16 Jun, 13:19 UTC. Infosecurity, first report. Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts.
- Tue 16 Jun, 14:27 UTC. The Hacker News, its first report on the story. Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds.
- Tue 16 Jun, 18:25 UTC. Dark Reading, its first report on the story. Rokarolla Android Trojan steals data, spies via fake apps.
- Wed 17 Jun, 11:50 UTC. Security Affairs, its first report on the story. Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps.
- Wed 17 Jun, 16:10 UTC. Malwarebytes, its first report on the story. Rokarolla malware steals bank, crypto logins via fake overlays. This article, 5th of 7.
- Thu 18 Jun, 11:07 UTC. SecurityWeek, its first report on the story. Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock.
- Thu 25 Jun, 07:10 UTC. SecurityOnline, its first report on the story. Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Tue 16 JunDay 03
- Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts13:19 · Infosecurity · First report
- Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds14:27 · The Hacker News
- Rokarolla Android Trojan steals data, spies via fake apps18:25 · Dark Reading
- Wed 17 JunDay 12
- Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps11:50 · Security Affairs
- Rokarolla malware steals bank, crypto logins via fake overlays16:10 · Malwarebytes · This article, 5th of 7
- Thu 18 JunDay 21
- Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock11:07 · SecurityWeek
Quiet for 7 days
Thu 25 JunDay 91- Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data07:10 · SecurityOnline · Picked up again