Next-Gen Android Trojan Herodotus Mimics Human Typing to Bypass Behavioral Biometrics Anti-Fraud Systems

Cybersecurity researchers at ThreatFabric have identified a new Android banking Trojan dubbed Herodotus, a hybrid that blends features from Brokewell and Hook while adding the ability to mimic human typing to evade behavioural biometric anti-fraud systems. ThreatFabric notes that Herodotus aims to perform credential theft and remote control, using randomised typing delays during remote-control sessions to resemble real user action.

The campaign has been observed in Italy and Brazil, spread via side-loading and SMiShing to install a malicious dropper, with an overlay that imitates a loading screen to hide the permissions being granted. The malware can display opaque overlays during operation, and its operators can perform clicks, swipes, text input, and global actions such as Back or Home to simulate legitimate app usage.

The author is identified as “K1R0”, and ThreatFabric reports seven active Herodotus C2 subdomains under the domain google-firebase[.]digital, with early campaigns targeting additional regions, including the United States, the UK, and others.