SecurityWeekEduard Kovacs
Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock
Part of the Rokarolla story · since 16 Jun
- Tue 16 Jun, 13:19 UTC. Infosecurity, first report. Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts.
- Tue 16 Jun, 14:27 UTC. The Hacker News, its first report on the story. Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds.
- Tue 16 Jun, 18:25 UTC. Dark Reading, its first report on the story. Rokarolla Android Trojan steals data, spies via fake apps.
- Wed 17 Jun, 11:50 UTC. Security Affairs, its first report on the story. Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps.
- Wed 17 Jun, 16:10 UTC. Malwarebytes, its first report on the story. Rokarolla malware steals bank, crypto logins via fake overlays.
- Thu 18 Jun, 11:07 UTC. SecurityWeek, its first report on the story. Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock. This article, 6th of 7.
- Thu 25 Jun, 07:10 UTC. SecurityOnline, its first report on the story. Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data.
A new banking trojan named 'Rokarolla' has been identified by mobile security firm Zimperium, targeting over 200 cryptocurrency and banking applications on Android devices. Distributed via malicious websites disguised as popular apps, Rokarolla impersonates Google Play Protect to deliver its payload. Once installed, it requests extensive permissions and can capture device lock credentials, allowing for theft of sensitive information even while the device is locked.
The malware can exfiltrate data through phishing screens, steal WhatsApp contacts, harvest SMS messages, hijack calls, and includes keylogger functionality to track user inputs. It employs stealth techniques such as hiding its app icon, muting notifications, and capturing screenshots without the user's knowledge, making detection challenging.
How the story developed
7 articles from 7 outlets since 16 Jun. Quiet since 25 Jun. This was the 6th report, 2 days after the first.
- Tue 16 Jun, 13:19 UTC. Infosecurity, first report. Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts.
- Tue 16 Jun, 14:27 UTC. The Hacker News, its first report on the story. Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds.
- Tue 16 Jun, 18:25 UTC. Dark Reading, its first report on the story. Rokarolla Android Trojan steals data, spies via fake apps.
- Wed 17 Jun, 11:50 UTC. Security Affairs, its first report on the story. Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps.
- Wed 17 Jun, 16:10 UTC. Malwarebytes, its first report on the story. Rokarolla malware steals bank, crypto logins via fake overlays.
- Thu 18 Jun, 11:07 UTC. SecurityWeek, its first report on the story. Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock. This article, 6th of 7.
- Thu 25 Jun, 07:10 UTC. SecurityOnline, its first report on the story. Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Tue 16 JunDay 03
- Rokarolla Android Trojan Hijacks Devices, Drains Bank Accounts13:19 · Infosecurity · First report
- Android Malware Rokarolla Steals PINs, SMS Codes and Crypto Funds14:27 · The Hacker News
- Rokarolla Android Trojan steals data, spies via fake apps18:25 · Dark Reading
- Wed 17 JunDay 12
- Rokarolla Android Trojan hits banks via fake TikTok, Chrome apps11:50 · Security Affairs
- Rokarolla malware steals bank, crypto logins via fake overlays16:10 · Malwarebytes
- Thu 18 JunDay 21
- Rokarolla Android Trojan Hits 200 Banking Apps, Evades Lock11:07 · SecurityWeek · This article, 6th of 7
Quiet for 7 days
Thu 25 JunDay 91- Rokarolla Android Trojan Takes Devices, Steals Crypto & Bank Data07:10 · SecurityOnline · Picked up again