[REVISION HISTORY]

Android banking trojan evolution

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-16 12:59 UTC → 2026-10-25 07:23 UTC · added ~~removed~~

Cybersecurity researchers have identified evolving threats targeting Android mobile banking users through sophisticated malware strains. In late September 2026, reports emerged regarding the RatHat and RemControl trojans. RatHat utilizes Google’s Gemini AI to analyze intercepted messages and estimate victim bank balances, allowing operators to prioritize high-value accounts. Cleafy reported approximately 100 deployments of the RatHat control console since April 2026. RemControl has targeted over 30 financial institutions across Europe, including France, Italy, Spain, Poland, and Portugal, with researchers noting that portions of its code were generated using AI assistants to bypass security restrictions. By mid-October 2026, a new strain named Hirudo was discovered. Unlike previous methods using fake overlays, Hirudo aggressively replaces genuine banking applications with nearly identical counterfeit versions to steal credentials and intercept security codes. Researchers at ThreatFabric and STAR Labs noted that the infection typically begins through deceptive online advertisements for shopping, entertainment, or streaming services. Once installed, the malware uses a false update prompt to gain accessibility and notification permissions, allowing it to trigger an uninstaller for the original application while simultaneously installing the malicious copy. While RemControl and Hirudo are frequently distributed via social media platforms like Facebook and Instagram, Hirudo has specifically targeted eight banking applications in Indonesia. The malware is also attempting to steal credentials from users in China, India, Mexico, Morocco, and Thailand. Researchers have analyzed over 60 samples of such malicious applications that utilize Remote Access Trojan (RAT) capabilities to remotely control infected devices.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.