Android droppers evolved into versatile tools to spread malware

ThreatFabric researchers warn that Android droppers have shifted from delivering banking trojans to also spreading SMS stealers and spyware, with activity concentrated in Asia and India and other high-risk regions. According to ThreatFabric, dropper apps now deliver not just banking trojans but broader payloads, often disguising themselves as government or banking apps to evade scrutiny.

Google’s Pilot Program, designed to enhance Play Protect by scanning apps before installation in places like India and Brazil, is being exploited by threat actors who use droppers to appear harmless at install and fetch the real payload after user interaction. The researchers describe a staged dropper called RewardDropMiner that evades Play Protect and the Pilot Program, delivering spyware or other payloads while previously running a hidden Monero miner that has since been removed in newer variants.

Droppers such as SecuriDropper, Zombinder, BrokewellDropper, HiddenCatDropper and TiramisuDropper are cited as examples of methods used to delay permissions or hide payloads to reach victims despite Android defenses. September 03, 2025.