New Android Banking Trojan Uses Hidden VNC for Full Remote Control of Devices

According to Cleafy’s Threat Intelligence team, Klopatra is a new, highly sophisticated Android banking trojan and remote access trojan (RAT) that grants attackers full control of compromised devices and enables large-scale financial fraud, with active campaigns in Spain and Italy infecting over 3,000 devices. The malware stands out for integrating Virbox, a commercial-grade code protection tool, and for shifting core logic from Java to native C/C++ libraries to reduce visibility to static and runtime detectors.

It uses a dropper masquerading as “Mobdro Pro IP TV + VPN” to lure users into granting unknown-app permissions, then requests Accessibility Services to monitor screens, record inputs, and simulate taps. A built-in VNC server offers Standard and Hidden modes, with the latter showing a black overlay to keep the device appearing off while the operator acts in stealth.

The overlay and data-exfiltration modules inject login screens into banking apps and exfiltrate credentials, along with device metadata to the C2 servers, where Turkish-language function names and notes indicate a Turkish-speaking operator group behind development and fraud execution. Infections include about 2,433 on adsservices[.]uk (Spain) and 495 on adsservice2[.]org (Italy), with a smaller third server and nine bots on a staging domain.