Herodotus Android malware mimics human typing to evade detection

Threat Fabric researchers have uncovered a new Android banking Trojan, named Herodotus, that mimics human typing by introducing random delays to evade detection, with campaigns detected in Italy and Brazil. Described as a malware-as-a-service (MaaS) offering, Herodotus enables operators to takeover devices and bypass behaviour biometrics, using a dropper to install the payload and then prompt users to enable an Accessibility service.

According to Threat Fabric, the malware hides its activity with overlays and a “block overlay” during the credential-stealing phase, and it can simulate real user input by breaking keystrokes into single characters with random delays of 0.3 to 3 seconds. It supports full device takeover, including overlay attacks, SMS theft for 2FA, Accessibility logging, and remote-control actions via an operator panel that exposes a Delayed text input feature.

The infrastructure uses the MQTT protocol and the domain google-firebase[.]digital with seven active subdomains, targeting campaigns in Italy and Brazil and linking to variants such as a Banca Sicura app and a Modulo Seguranca Stone disguise, while continuing to evolve.