Sturnus Trojan Bypasses WhatsApp/Signal Encryption & Takes Over Android Devices

MTI Security researchers have identified a sophisticated new Android banking trojan called Sturnus, notable for its capability to take over devices and bypass encrypted messaging without breaking the underlying encryption. The malware can compromise communications on WhatsApp, Telegram and Signal by using the Android Accessibility Service to capture screen content after the legitimate app has decrypted it, giving attackers a real-time view of conversations and messages.

According to ThreatFabric, the capability “completely sidesteps end-to-end encryption by accessing messages after they are decrypted by the legitimate app.” Sturnus is designed for comprehensive fraud, harvesting banking credentials via convincing fake login screens and granting extensive remote-control over the infected device, including a Black Screen Overlay to mask fraudulent transactions in the background.

It uses both pixel-based screen streaming and a UI-tree control layer for remote sessions, enabling precise actions with minimal bandwidth and without triggering standard screen-capture indicators. The malware targets financial institutions in Southern and Central Europe and persists by abusing Android Device Administrator privileges, with a complex C2 mix of HTTP and WebSocket using strong AES encryption.