Spy, Steal, Lock: deVixor Android Trojan Hits Banking & Crypto Users

January 14, 2026 marks the publication of a report on deVixor, an Android banking malware campaign that CRIL notes has been aggressively targeting Iranian users since October 2025. The threat combines the stealth of a spy with ransomware capabilities, evolving from a simple SMS harvester into a fully featured remote access trojan. It is distributed via phishing websites that masquerade as legitimate automotive businesses, prompting users to download malicious APKs.

Once installed, deVixor requests intrusive permissions to harvest SMS-based financial information, including OTPs, account balances, card numbers and messages from banks and cryptocurrency exchanges. The malware uses WebView-based JavaScript injection to capture banking credentials and operates a modular platform with capabilities such as a KEYLOGGER and commands like GET_SCREENSHOTS and GET_GALLERY, with a remotely triggered ransomware module to lock devices if data theft proves insufficient.

Telegram is used for its command-and-control infrastructure, and the campaign shows deliberate victim profiling and regional focus on Iranian banks, payment services and crypto platforms. According to Cyble Research and Intelligence Lab (CRIL).