New Sturnus Android Trojan Quietly Captures Encrypted Chats and Hijacks Devices

Cybersecurity researchers have disclosed details of a new Android banking trojan named Sturnus, which can steal credentials and take full control of the device to facilitate financial fraud. A key differentiator cited by ThreatFabric is Sturnus’s ability to bypass encrypted messaging by capturing content directly from the device screen after decryption, enabling monitoring of WhatsApp, Telegram, and Signal chats.

The malware also can stage overlay attacks with fake login screens and uses Android’s accessibility services to capture keystrokes and UI interactions, while overlayed targets are disabled to avoid user suspicion. It communicates with a remote server over WebSocket and HTTP to register devices and receive encrypted payloads, and can allow operators to interact with the device during VNC sessions.

ThreatFabric notes that the threat is privately operated, region-specific overlays target financial institutions in Southern and Central Europe, and the campaign remains in an evaluation stage with uninstall and removal blocked while administrator rights persist.