Android Droppers Now Deliver SMS Stealers and Spyware, Not Just Banking Trojans

Android droppers are shifting from primarily delivering banking trojans to distributing SMS stealers and spyware, researchers say, with campaigns run by dropper apps that mimic government or banking apps in India and other parts of Asia. ThreatFabric noted that Google’s Pilot Program and Play Protect’s heightened protections are prompting attackers to seek ways around safeguards, such as presenting a harmless update screen that only fetches the payload after the user clicks Install.

One dropper, RewardDropMiner, has been observed delivering spyware alongside a Monero miner that can be activated remotely, though recent variants no longer include the miner functionality. Google told The Hacker News it has not found any such apps on Google Play, emphasising that Play Protect helps keep users safe and that protections were already in place before this report.

The report cites Bitdefender Labs, which warned of a malvertising campaign using Facebook ads to push a TradingView Android app that installs a more capable Brokewell banking trojan, with no fewer than 75 malicious ads run since 22 July 2025 reaching tens of thousands in the EU. Some dropper variants avoiding Play Protect include SecuriDropper, Zombinder, BrokewellDropper, HiddenCatDropper, and TiramisuDropper, underscoring the ongoing cat-and-mouse between attackers and mobile security measures.