Security AffairsPierluigi Paganini
Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps
Part of the Rokarolla story · since 16 Jun
- Tue 16 Jun, 13:19 UTC. Infosecurity, first report. Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts.
- Tue 16 Jun, 14:27 UTC. The Hacker News, its first report on the story. Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds.
- Tue 16 Jun, 18:25 UTC. Dark Reading, its first report on the story. Rokarolla Android Trojan steals data, spies via fake apps.
- Wed 17 Jun, 11:50 UTC. Security Affairs, its first report on the story. Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps. This article, 4th of 7.
- Wed 17 Jun, 16:10 UTC. Malwarebytes, its first report on the story. Rokarolla malware steals bank, crypto logins via fake overlays.
- Thu 18 Jun, 11:07 UTC. SecurityWeek, its first report on the story. Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock.
- Thu 25 Jun, 07:10 UTC. SecurityOnline, its first report on the story. Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data.
The article discusses the Rokarolla Android Trojan, which targets 217 banking and crypto applications, stealing user credentials and interfering with device functionality. This malware spreads through malicious sites disguised as popular apps like TikTok and Google Chrome, using a dropper that masquerades as Google Play Protect to gain access. Once installed, it can simulate user taps, display fraudulent overlays to capture sensitive information, and intercept SMS messages.
Rokarolla can block incoming calls, mute device sounds, and silently rewrite clipboard data, making it highly evasive and persistent. Researchers from Zimperium advise against granting accessibility access to unknown apps and stress the importance of downloading apps only from trusted sources.
How the story developed
7 articles from 7 outlets since 16 Jun. Quiet since 25 Jun. This was the 4th report, 23 hours after the first.
- Tue 16 Jun, 13:19 UTC. Infosecurity, first report. Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts.
- Tue 16 Jun, 14:27 UTC. The Hacker News, its first report on the story. Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds.
- Tue 16 Jun, 18:25 UTC. Dark Reading, its first report on the story. Rokarolla Android Trojan steals data, spies via fake apps.
- Wed 17 Jun, 11:50 UTC. Security Affairs, its first report on the story. Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps. This article, 4th of 7.
- Wed 17 Jun, 16:10 UTC. Malwarebytes, its first report on the story. Rokarolla malware steals bank, crypto logins via fake overlays.
- Thu 18 Jun, 11:07 UTC. SecurityWeek, its first report on the story. Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock.
- Thu 25 Jun, 07:10 UTC. SecurityOnline, its first report on the story. Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Tue 16 JunDay 03
- Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts13:19 · Infosecurity · First report
- Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds14:27 · The Hacker News
- Rokarolla Android Trojan steals data, spies via fake apps18:25 · Dark Reading
- Wed 17 JunDay 12
- Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps11:50 · Security Affairs · This article, 4th of 7
- Rokarolla malware steals bank, crypto logins via fake overlays16:10 · Malwarebytes
- Thu 18 JunDay 21
- Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock11:07 · SecurityWeek
Quiet for 7 days
Thu 25 JunDay 91- Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data07:10 · SecurityOnline · Picked up again