Albiriox: The Russian ‘MaaS’ Android Trojan Redefining Mobile Fraud

According to Cleafy Threat Intelligence, Albiriox is a newly identified Android banking trojan offered as a Malware-as-a-Service (MaaS), combining on-device fraud capabilities with remote control and real-time interaction. The operation began with a private beta in September 2025 and launched publicly in October 2025, with infrastructure and linguistic patterns suggesting Russian-speaking threat actors. The service is reportedly rented out for approximately $650 to $720 per month.

One of the first observed campaigns targeted Austria using a social engineering lure via a fake Penny Market app, where users accessing “coupons” triggered a two-stage infection chain. Albiriox features AcVNC, an accessibility-based streaming mechanism designed to bypass Android’s FLAG_SECURE protections and screen-blocking measures, enabling attackers to view and control the device.

Researchers found a hardcoded list of over 400 targets worldwide and noted the inclusion of Golden Crypt in the builder pipeline, underscoring the malware’s professional, stealth-optimised MaaS model.