Herodotus: New Android Malware Mimics Human Behavior to Bypass Biometric Security

Herodotus is a sophisticated new Android banking Trojan that mimics human typing patterns to evade behavioural biometrics detection. Discovered by ThreatFabric’s Mobile Threat Intelligence team, it uses randomized delays between keystrokes, ranging from 300 to 3,000 milliseconds, and even offers operators a control panel with buttons labelled “SEND 1” and “SEND 2” plus a “Delayed text” option to tailor inputs.

The malware’s multi-stage infection chain begins with SMiShing campaigns that drop the malicious applications, after which it requests Accessibility Service permissions via fake loading screens to obscure real grants.

It communicates with its command-and-control infrastructure using MQTT to receive targeting instructions and overlay pages for credential harvesting, and it is marketed as Malware-as-a-Service by threat actor “K1R0.” Campaigns have been observed in Italy and Brazil, with overlays also targeting the United States, United Kingdom, and other regions, while researchers note connections to Brokewell’s techniques.

As such, experts warn that relying solely on interaction tempo and keystroke cadence is insufficient for defence, prompting calls for layered detection across devices and environments.