Researchers Uncover BankBot-YNRK and DeliveryRAT Android Trojans Stealing Financial Data

Cybersecurity researchers have detailed two Android trojans, BankBot-YNRK and DeliveryRAT, capable of harvesting sensitive data from infected devices, according to CYFIRMA. BankBot-YNRK analyses three samples and includes checks for virtualisation, device details, and targeted models, while the malware’s APKs impersonate a government app under the name IdentitasKependudukanDigital.apk with package names such as com.westpacb4a.payqingynrk1b4a and related variants.

Once installed, it collects device information, sets various audio streams to zero to avoid alerting the user, and uses the Android JobScheduler for persistence and post‑reboot launches, with commands that can grant device administrator privileges and access contacts, SMS, locations, and more.

DeliveryRAT, disclosed by F6, is advertised via a MaaS Telegram bot named Bonvi Team and targets Russian Android users, with victims latched onto fake orders and marketplaces to install the malware, which can also request notification and battery‑optimisation access and even perform DDoS‑capable actions. The report notes the malware’s ongoing activity since mid‑2024 and mentions a broader NFC‑related abuse trend highlighted by Zimperium, where fake financial apps misuse NFC to exfiltrate payment data.