Android Malware Mutes Alerts, Drains Crypto Wallets

Security researchers have identified Android/BankBot-YNRK as a highly capable new mobile banking Trojan targeting Indonesia, masquerading as genuine apps inside legitimate-looking versions of Identitas Kependudukan Digital. According to Cyfirma, the malware uses Android’s accessibility features to gain full remote control, intercept SMS messages, and steal data such as passwords and cryptocurrency keys, while employing obfuscation, anti-emulation checks and persistent mechanisms to endure reboots.

It primarily targets devices running Android 13 and earlier, since Android 14 restricts its ability to bypass permissions via accessibility features, Cyfirma noted. The Trojan disables all audio alerts, takes real-time screenshots to map banking app layouts, and automates UI actions to exfiltrate credentials and manipulate transactions, including acting as a controller for cryptocurrency wallets.

It hides its activities by spoofing as Google News, loads google[.]com inside a WebView, and uses Android’s JobScheduler to maintain long-term persistence. Intel471’s findings are also cited in the piece to highlight a broader rise in advanced Android malware and droppers used to sidestep newer OS restrictions.