Frogblight threatens you with a court case: a new Android banker targets Turkish users

According to Securelist, Frogblight is a new Android banking Trojan that was first observed in August 2025, targeting individuals in Turkey. It initially masqueraded as an app for accessing court case files via an official government webpage, with later variants disguising themselves as the Chrome browser.

The malware can steal banking credentials and includes spyware features such as harvesting SMS messages, listing installed apps, and collecting device filesystem information, and it can also send arbitrary SMS messages. It uses a WebView-driven flow that directs victims to sign in on banks’ websites, then injects JavaScript to capture input data and exfiltrate it via a REST API to a command-and-control server; some samples have even used a WebSocket-based channel.

Frogblight shows signs of active development, with new features appearing through September and indications it may be distributed under a MaaS model, and telemetry suggests most victims are located in Turkey. The threat is described as an advanced banking Trojan (with Turkish-language code comments) that can persist on devices and evolve with additional capabilities, according to Securelist.