NewsRobert Haba
Hirudo Android malware replaces banking apps to bypass security controls
Hirudo Android malware replaces legitimate banking apps with modified copies to bypass checks and steal credentials, according to ThreatFabric.
Browse all articles, news, and guides tagged with malware on Droid Tools.
Hirudo Android malware replaces legitimate banking apps with modified copies to bypass checks and steal credentials, according to ThreatFabric.
Shoppers who buy low-cost Android phones from online marketplaces may be getting malware that was planted on the device before it ever reached them, Bitdefender has found. The Midnight Mimosa malware campaign runs on budget Android phones from several brands built on MediaTek platforms. The malicious code ships inside the firmware, is already there when
Bitdefender has discovered and analyzed a campaign dubbed Midnight Mimosa, in which malware comes preinstalled in the firmware of low-cost Android devices built on MediaTek platforms. The infection is persistent, runs as a pre-installed firmware system app, and can’t be removed through normal uninstall procedures. Anyone who switches on an affected device finds the malware
Cybersecurity researchers at Huntress have uncovered a campaign where hackers built a custom ChatGPT model to trick people into launching malware on their own PCs, turning one of OpenAI's own features against its users. The campaign starts on Google search. Anyone searching for “chatgpt” might click a sponsored ad at the top of the results
Cybersecurity researchers at ThreatFabric have disclosed a new Android banking trojan called StreamRat that was pushed to Spanish-speaking users through a fake television-streaming campaign on Meta and can hand its operators near-complete control of an infected device. According to ThreatFabric, the campaign's advertising focused on Spain and reached an estimated 570,950 Meta accounts in the
Kaspersky ICS CERT has publicly detailed a critical hardware vulnerability hitting a wide array of Qualcomm Snapdragon chipsets. The exploit, presented at Black Hat Asia 2026 on April 23 and tracked as CVE-2026-25262, has rattled the security community. First confirmed by Qualcomm in April 2025, full technical details are now available, exposing a backdoor capable
Two groups of researchers have found two new, distinct types of malware that function similarly and are embedded in a variety of programs that are accessible through different channels. Worst of all, the standard advice to “don't install apps from strange sites” is less helpful because some of them are even available on the Google
We recently reported about another type of banking Android malware that operates in the background and leverages accessibility settings to steal data, including passwords and bank credentials. More malware that allows remote attacks on Android devices and is freely disseminated among hackers as part of a subscription service has just been disclosed. More banking malware
A new Android-based spyware that leverages NFC technology to make illegal ATM cash withdrawals and empty victims' bank accounts was examined by the Polish Computer Emergency Response Team (CERT Polska). Researchers discovered that the software, known as NGate, allows attackers to use banking information stolen from victims' phones to withdraw money from ATMs (Automated Teller
According to a survey by cloud security firm Zscaler, hundreds of malicious Android apps on Google Play were downloaded over 40 million times between June 2024 and May 2025. The company saw a 67% year-over-year increase in malware that targeted mobile devices during that time, with banking trojans and spyware being the most common threats.
Even though your mobile device has many built-in safeguards to preserve your privacy and keep your data safe, it could still be subject to snooping if someone you know gains access to your accounts or installs hidden programs, or stalkerware, that follow you about. These malicious apps may spy on you by taking use of
Android devices are extremely popular, mainly due to their open-source model, wide range of device options, and affordability, which makes them appealing to a broad demographic and accessible to people from diverse incomes. However, due to its popularity, it makes Android devices an easy target for attacks, resulting in multiple risks associated with storing sensitive
Using a warning to backup the key to prevent losing access, a recently identified Android malware known as Crocodilus deceives users into entering the seed phrase for the bitcoin wallet. Despite being a recent banking malware, Crocodilus has fully functional capabilities to remotely control, take over the device, and collect data. According to researchers at
Together with Google, Trend Micro, The Shadowserver Foundation, and other partners, researchers from HUMAN's Satori Threat Intelligence team were able to take down BadBox 2.0, the biggest network of compromised connected TV sets. The BadBox malware typically comes pre-installed on TV streaming boxes, smart TVs, tablets, digital projectors, or smartphones, and it infects a botnet
The new Glove Stealer malware can collect browser cookies by getting past Google Chrome's Application-Bound (App-Bound) encryption. This information-stealing virus is “very simple and contains limited obfuscation or protective features,” suggesting that it is most likely still in its early stages of development, according to Gen Digital security researchers who first discovered it when looking
Now more than ever, we depend on digital devices like smartphones and computers for work and entertainment. Users want a smooth experience. However, there are times when our devices show signs of poor performance and other issues. Let’s take a look at some of the most common problems and methods to minimize or eliminate these
Apps that appear to be normal but are occasionally compromised with malware are extremely common. Users should always update their gadgets, keep an eye out for articles like this one, and take appropriate action. A virus campaign is affecting over 60 well-known apps with a combined install base of over 100 million in the Google
Popular apps have been pulled from the Google Play store, and users of Android devices are being asked to do so right away. Millions of users have downloaded the harmful apps, which pose as questionnaire, fitness, or gaming apps and lure users into accepting bogus incentives or clicking on links that take them to dubious
Unknown Android spyware called “BadBazaar” has been found to target China's ethnic and religious minorities, particularly the Uyghurs in Xinjiang. Due to their cultural divergence from traditional eastern Chinese values, the central Chinese government has subjected the 13 million-strong Uyghur Muslim minority to extreme oppression. The new spyware was originally discovered by MalwareHunterTeam and linked to Bahamut in VirusTotal detections.
Over 3,000,000 people downloaded a new Android malware family from the Google Play Store that discreetly subscribes users to premium services. Maxime Ingrao, an Evina security researcher, found the malware, known as “Autolycos,” in at least eight Android applications, of which two are still downloadable from the Google Play Store as of this writing. The
