New FvncBot Android Trojan Targets mBank Users with HVNC and H.264 Screen Streaming

A sophisticated new Android banking trojan, dubbed FvncBot, has been found targeting mBank customers in Poland.

According to Intel 471, the malware masquerades as a legitimate security app to steal credentials and take remote control of victims’ devices, first being observed on 25 November 2025 when distributed as “Klucz bezpieczeństwa Mbank.” The loader and payload are said to be obfuscated with the apk0day crypting service operated by the GoldenCrypt actor, and the trojan claims a

range of surveillance and fraud capabilities including keylogging via Android accessibility services, web-inject attacks, screen streaming and hidden virtual network computing (HVNC). Its screen streaming uses the H.264 video standard to enable low-latency transmission, while the text mode HVNC allows attackers to reproduce the device UI and interact programmatically, even if an app blocks screenshots.

Management of infected devices is handled via Firebase Cloud Messaging, with WebSocket communications established through the Fast Reverse Proxy for near-real-time remote control.