Herodotus: The Android Trojan That Types Like You

The SOCRadar analysis describes Herodotus as an advanced Android banking trojan that blends dropper apps masquerading as legitimate banking or security tools with fraud-detection evasion. It first appeared in campaigns in Italy and Brazil and has since spread to the United States, the United Kingdom, Turkey, Poland, and Ireland, expanding its reach across sectors that rely on mobile banking and payments.

The malware relies on SMiShing to deliver malicious dropper applications, then uses Accessibility permissions and overlay windows to steal credentials and intercept 2FA codes while simulating user input with randomized typing delays from 300 to 3000 milliseconds. It communicates with a C2 server via MQTT, and its infrastructure is based on google-firebase[.]digital domains with dynamic subdomains, enabling remote input injection and targeted overlays.

The campaign is facilitated by a Malware-as-a-Service model and targets financial services, fintech, and crypto wallet platforms; there are no confirmed links to any APT group, though the FAQ notes an independent actor named K1R0 as a claimed attribution.