Home / Technology / Android Banking Malware Empties Accounts Silently
Android Banking Malware Empties Accounts Silently
24 Dec, 2025
Summary
- New Sturnus malware captures decrypted messages directly from the screen.
- It uses HTML overlays and keylogging to steal banking credentials.
- The malware can block removal by taking Device Administrator privileges.
A newly developed Android banking trojan, dubbed Sturnus, poses a significant threat by stealthily stealing banking credentials and personal data. This malware operates by capturing decrypted messages directly from the screen, circumventing end-to-end encryption. It employs deceptive HTML overlays that mimic legitimate banking applications to trick users into entering sensitive information, which is then forwarded to attackers.
Sturnus leverages aggressive keylogging through the Android Accessibility Service to record every keystroke and monitor app activity. Even when screenshots are blocked, it reconstructs user actions by tracking UI elements in real-time. The malware also steals chat messages from popular apps like WhatsApp, Telegram, and Signal after they are decrypted on the device, providing attackers with full visibility.
To protect against such threats, users should avoid downloading APKs from untrusted sources, be wary of requests for excessive permissions like Device Administrator or Accessibility, and promptly install system updates. Employing reputable antivirus software and considering a personal data removal service can further enhance security against evolving mobile threats like Sturnus.
