Sturnus: New Android banking trojan targets WhatsApp, Telegram, and Signal

Sturnus is a new Android banking trojan that targets WhatsApp, Telegram and Signal, with its discovery noted in ThreatFabric’s report and dated 20 November 2025. ThreatFabric analysis indicates the malware is still under development or operating in a limited testing phase, but it already targets financial institutions across Southern and Central Europe.

The trojan has full device‑takeover abilities, bypassing encrypted messaging by capturing on‑screen content, monitoring the foreground app, and automatically activating its UI‑tree collection when encrypted messaging services are opened. It uses two data‑exfiltration methods—HTML overlays and accessibility‑based keylogging—with phishing templates stored for targeted banking apps and delivered via a WebView to capture input.

The malware can perform real‑time monitoring of conversations by reading screen content, effectively sidestepping end‑to‑end encryption, and it enables full remote control of infected devices through screen streaming and a VNC RFB‑based session. Sturnus also strengthens persistence by obtaining Device Administrator rights and tracking a range of device states to maintain long‑term control. According to ThreatFabric, the campaign appears to be progressing with region‑specific templates and intermittent execution patterns.