Hook v3: The Banking Trojan That’s Evolving into a Hybrid Ransomware-Spyware Threat

The zLabs researchers at Zimperium have unveiled Hook v3, the latest evolution of the Android banking trojan, which now functions as a multi‑functional hybrid that includes spyware and ransomware‑style capabilities. The update introduces ransomware overlays, fake NFC overlays, a deceptive lockscreen overlay, and transparent overlays, with the malware also capable of stealthy screen‑streaming sessions for real‑time device monitoring.

According to Zimperium, the total remote command set has risen to 107, with 38 newly added in this update. Distribution remains broad, as threat actors push it via phishing campaigns and host malicious APKs in GitHub repositories, a method not limited to Hook alone. The analysis also notes signs of Telegram‑based C2 features in development, and confirms Hook v3 continues to abuse Android Accessibility Services to automate fraud, control devices, and bypass defenses. 27 August 2025.