Home / Technology / New Android Trojan 'Rokarolla' Targets 217 Banking Apps
New Android Trojan 'Rokarolla' Targets 217 Banking Apps
17 Jun
Summary
- A new Android banking trojan named Rokarolla targets over 200 banking and crypto apps.
- Rokarolla distributes via fake websites, tricking users into installing malware.
- The trojan steals credentials using invisible overlays and adds spying features.
A newly discovered Android banking trojan, Rokarolla, poses a significant threat by targeting 217 banking and cryptocurrency applications. Security researchers identified this malware, which is being distributed through malicious websites and unofficial app stores, avoiding official repositories like Google Play. These sites often advertise popular apps but deliver a dropper that disguises itself as the Google Play Protect security feature. Upon installation, Rokarolla requests broad permissions, including Accessibility services, and scans for targeted financial applications. It then deploys invisible overlays to capture user credentials, including PINs and unlock patterns, when specific apps are opened. The trojan employs several stealth tactics, such as hiding its icon and disabling notifications, to evade detection. Additionally, Rokarolla possesses capabilities for keystroke logging, call blocking, and screen recording, further compromising user data and privacy.
