Datzbro Trojan: Spyware-Banking Malware Hijacks Seniors’ Devices with Fake Facebook Lures

ThreatFabric researchers have uncovered a sophisticated scam campaign that uses social engineering and mobile malware to target seniors, introducing a newly discovered Android Trojan named Datzbro, described as a hybrid spyware and banking threat with remote-control capabilities. The campaign begins with fake Facebook groups promoting “active senior trips” and other community activities, with AI-generated content and groups spanning Australia, Singapore, Malaysia, Canada, South Africa, and the UK.

Victims are invited to join via Messenger or WhatsApp and prompted to download a “community application” to register for events, with the Google Play button triggering the Datzbro payload directly or via the Zombinder dropper designed to bypass Android 13+ restrictions, according to ThreatFabric.

The malware is characterised as providing remote screen sharing, black overlay attacks, and a broad remote-control mode, plus accessibility logging that filters for banking and crypto apps, enabling credential theft and potential financial fraud.

Analysis points to a Chinese origin, with debug strings in Chinese and samples labelled “最强远控.apk” (“The most powerful remote control”), and ThreatFabric notes that the C2 panel is a desktop application and that the builder has been leaked online, making Datzbro freely available. ThreatFabric concludes that Datzbro marks a significant convergence of spyware and banking Trojan capabilities, leveraging AI-generated content and social platforms to expand its reach.