New Android Trojan “Datzbro” Tricking Elderly with AI-Generated Facebook Travel Events

ThreatFabric has flagged a previously undocumented Android banking trojan named Datzbro, discovered in August 2025 after reports of Facebook groups promoting “active senior trips” in Australia. The campaign targets the elderly, using AI-generated content to promote social events and then delivering the malware via APKs after victims are invited to download a “community application” through Messenger or WhatsApp.

According to ThreatFabric, the malware can take control of devices, perform remote actions, and conduct fraud through overlay attacks, keylogging, and credential theft for apps like Alipay and WeChat, with a schematic remote control mode that reports display elements, positions and content to aid re-creation on the attacker side.

The campaign also features a dropper mechanism built with Zombinder to bypass security restrictions on Android 13 and later, and several sample apps associated with the Datzbro operation have been identified, including Senior Group and Lively Years. It is believed by ThreatFabric that Datzbro is the work of a Chinese-speaking threat group, with a C2 backend linked to a Chinese-language desktop application, and a compiled C2 app later leaked to public virus shares.

According to ThreatFabric, the discovery highlights how social engineering via trusted community activities can enable device takeover and financial fraud.