New Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a Human

According to ThreatFabric, a new Android banking trojan named Herodotus is being used in active campaigns that target Italy and Brazil to conduct device takeover (DTO) attacks. The Dutch security company notes that Herodotus was first advertised in underground forums on 7 September 2025 as part of a malware-as-a-service model and runs on devices with Android versions 9 to 16.

It abuses accessibility services to interact with screens, present opaque overlay screens, and steal credentials by displaying fake login prompts atop financial apps, while also capable of stealing 2FA codes sent via SMS and intercepting on-screen content. A standout feature is its ability to humanise fraud by introducing random delays when initiating remote actions such as typing, with ThreatFabric stating delays range from 300 to 3000 milliseconds to mimic human input and evade timing-based detections.

The malware is spread via dropper apps masquerading as Google Chrome and distributed through SMS phishing or social engineering, with operators aiming to expand to additional financial organisations and cryptocurrency wallets. ThreatFabric notes Herodotus borrows techniques from the Brokewell banking Trojan and appears designed to persist inside live sessions rather than merely steal static credentials.