Frogblight Android Banking Trojan Targets Turkey via Fake E-Gov Smishing and WebView

A new Android banking Trojan named Frogblight has been discovered targeting individuals in Turkey, masquerading as official government applications to harvest financial data, according to Kaspersky researchers who first identified the malware in August 2025. The infection chain begins with a deceptive SMS pushing recipients to a phishing site that mimics an official e-government portal, where victims are invited to download an app to view alleged court files.

Once installed, Frogblight requests extensive permissions and then opens the government page in WebView, using the legitimate login as a decoy while it prepares to capture banking credentials. The malware is described as a spyware tool that can collect SMS messages, list installed apps and access device filesystem information, and it can intercept banking authentication when the user selects a bank via the government portal.

Researchers note potential links to the Coper family through a MaaS model, with a GitHub presence suggesting operators may reuse tools across campaigns; Frogblight has been developing rapidly, adding features such as WebSocket communication and emulator detection.