Klopatra: New Android RAT Uses Hidden VNC and Commercial Obfuscation to Hijack European Banking Accounts

Klopatra, a new Android Remote Access Trojan, has been uncovered with hidden VNC capabilities and commercial obfuscation that aims to hijack European banking accounts. According to Cleafy, the threat uses native libraries and Virbox to complicate detection and analysis, and it can exploit Android Accessibility Services to monitor screens, capture keystrokes, and act invisibly on behalf of the user.

The campaign began with a social engineering lure, where victims download a dropper disguised as a pirated IPTV app called “Mobdro Pro IP TV + VPN,” after which the dropper installs the main Klopatra payload. Once active, it offers Standard VNC for real-time control and Hidden VNC, where the victim’s screen is blacked out while banking transactions proceed.

Cleafy identifies a Turkish-speaking group as the operators, with Turkish terms and notes embedded in the code and backend, and notes a live nocturnal fraud scenario where funds were transferred while the device was idle. Since March 2025, at least 40 builds have been tracked, with Spain and Italy cited as primary targets and approximately 1,000 and 450 devices affected respectively.