Loading malware…
Klopatra is an Android banking trojan and remote access trojan (RAT) first observed in March 2025. It is described as a previously undocumented malware family, with reporting indicating no confirmed links to earlier documented Android malware families. The malware has infected more than 3,000 devices, with the majority of observed infections reported in Spain and Italy, and broader targeting across Europe. Multiple reports associate the operation with a Turkish-speaking cybercrime group and describe it as having roots in Turkey.
Klopatra is distributed outside Google Play, commonly via social-engineering lures using dropper apps disguised as benign IPTV/VPN software, including “Modpro IP TV + VPN.” The dropper persuades victims to allow installation from unknown sources and then installs the main payload. The malware abuses Android Accessibility Services to capture screen content and user input, simulate taps and gestures, expand privileges, and support remote control.
Its capabilities include overlay attacks for stealing banking credentials, exfiltration of clipboard contents and keystrokes, screen monitoring, gesture simulation, and collection of information related to cryptocurrency wallet applications. A notable feature is its hidden or black-screen VNC mode, which allows operators to remotely control the device while it appears locked, idle, or inactive to the victim. Reporting states operators check conditions such as whether the device is charging, the screen is off, or the device is otherwise idle before activating this mode, then use it to access banking apps and perform fraudulent transactions, including draining accounts.
Klopatra also includes significant stealth and anti-analysis measures. Reported protections include Virbox commercial code protection, heavy use of native libraries, NP Manager string encryption in recent builds, code obfuscation, anti-debugging, runtime integrity checks, and emulator detection. It reportedly contains a hardcoded list of Android antivirus package names and attempts to uninstall targeted antivirus applications to evade detection.
Researchers reported exposed command-and-control infrastructure associated with two campaigns, including infrastructure obscured through Cloudflare where misconfiguration exposed origin IPs. Klopatra appears to be under active development, with approximately 40 distinct builds observed within months of its emergence. High-confidence infection and operational indicators mentioned in the content include the dropper name “Modpro IP TV + VPN,” use of hidden VNC/black-screen remote control, abuse of Accessibility Services, and targeting concentrated in Spain and Italy.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A previously undocumented Android banking trojan called Klopatra has compromised over 3,000 devices, with a majority of the infections reported in Spain and Italy.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth tactics: Virbox code protection, anti-debugging, emulator detection, AV app uninstall attempts.
Disguised as an IPTV + VPN app (“Modpro IP TV + VPN”) outside Google Play.
Capabilities may include overlay attacks on banking apps... These features allow attackers to conduct unauthorized transactions with minimal user awareness.
Capabilities include screen monitoring, overlay attacks for credential theft, gesture simulation, and clipboard/keystroke exfiltration.
Capabilities include screen monitoring, overlay attacks for credential theft, gesture simulation, and clipboard/keystroke exfiltration.
Capabilities include screen monitoring, overlay attacks for credential theft, gesture simulation, and clipboard/keystroke exfiltration.
Capabilities include screen monitoring, overlay attacks for credential theft, gesture simulation, and clipboard/keystroke exfiltration.
Capabilities include screen monitoring, overlay attacks for credential theft, gesture simulation, and clipboard/keystroke exfiltration.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android banking malware referenced as using covert remote control and overlay attacks for account theft.
Referenced as an Android malware family known for using live hidden VNC for covert screen interaction or surveillance.
Referenced as another known malware family sharing infrastructure connections with Perseus.
Referenced as an Android banking malware family that similarly abuses Android Accessibility services for banking fraud/credential theft techniques.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.