Loading malware…
Fakemoney is an Android malware family associated with fraudulent investment, payout, and financial-service scam applications. It is commonly classified by vendors as an Android trojan and has been repeatedly observed among the most prevalent mobile malware families affecting users at scale. The family is characterized by social-engineering lures that promise easy earnings, payments, or other financial benefits in order to trick victims into submitting personal data. Fakemoney apps masquerade as legitimate financial or income-generating services while functioning primarily as phishing-style data-harvesting tools.
Operational reporting across 2024 through 2026 shows Fakemoney remained highly active in the Android threat landscape, including periods in which it ranked among the most frequently detected mobile malware families and, in 2024, was described as the most active scam-app family in mobile telemetry. The malware has been noted alongside other prominent Android threats such as Triada and Mamont, but its core role is distinct: rather than acting as a banking trojan or backdoor, Fakemoney is primarily used to deceive users into voluntarily disclosing sensitive personal information under false financial pretenses.
The family targets Android users and is relevant to consumer mobile fraud rather than a specific enterprise vertical. Its infection vector is the lure itself: fake earning, payout, or financial-service applications presented as legitimate opportunities. High-confidence reporting supports personal-data theft through these scam apps, but does not establish broader capabilities such as banking credential interception, persistence mechanisms, or privilege escalation for this family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct technique documented for this family, organized by ATT&CK tactic.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android trojan family appearing in Q2 2026 top mobile malware detections with multiple variants.
Android trojan family appearing in the quarter's top mobile malware rankings in multiple variants.
Android trojan family with multiple variants appearing among the most frequently detected mobile malware in the quarter.
Android trojan family listed among the top mobile malware detections for the quarter.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.