'Klopatra' Trojan Makes Bank Transfers While You Sleep

Klopatra is described as an evasive new Android banking Trojan that can covertly drain victims’ money while they sleep. The malware is not a complete overhaul of the traditional banking Trojan model, but it is described as devilishly effective, with a remote access capability set that includes overlaying login screens, screen capture, and remote control.

It is most potent when attackers interact with a device as if they were holding it, enabling tasks such as simulating taps, unlocking the device, opening apps, and entering credentials to siphon funds via transfers to the attackers’ accounts. Cleafy’s report notes that the initial builds were first observed in March, with the malware coming into its own in the summer and infecting more than 3,000 devices in Italy and Spain.

European operators reportedly conduct remote manipulations during nighttime hours, when the device appears inactive, and the infection leverages a range of obfuscation techniques, including a Chinese packer called Virbox. According to Kern Smith, vice president of global solutions at Zimperium, banking malware now blends overlays, remote control, and social engineering to enable real-time fraud, emphasising the need for mobile-focused detection tools.