Loading malware…
Creduz is an Android banking Trojan family observed in mobile threat telemetry as part of the broader Android financial-malware ecosystem. It is classified as a mobile banker and has been tracked alongside other Android banking malware families such as Mamont, Faketoken, and Rewardsteal. Creduz has been notable for a sharp increase in discovered Android banking-Trojan samples during 2026, even when victim-side telemetry remained comparatively limited, indicating active development, variant churn, and likely experimentation with new functionality or defense-evasion approaches rather than clear evidence of the largest real-world campaign volume.
Creduz targets Android devices and is associated with the mobile banking threat category, implying credential-focused theft against financial applications and related user data. Available reporting supports its role as a banking Trojan on Android, but does not provide high-confidence detail on specific infection chains, persistence mechanisms, or post-compromise tradecraft unique to this family. It has been discussed in the context of malicious Android installation packages and the wider surge in mobile banking-Trojan activity, but concrete, family-specific delivery vectors are not established from the available information.
Operationally, Creduz appears to be under ongoing iteration by its operators, with numerous versions detected over a short period. That pattern is consistent with malware authors testing features, refining fraud capabilities, or attempting to bypass mobile security controls. No specific threat actor attribution, industry specialization, or geographically focused targeting is established at high confidence from the available information beyond its role in Android banking malware activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct technique documented for this family, organized by ATT&CK tactic.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android banking Trojan family whose share among identified banking samples increased significantly in Q2 2026, suggesting active iteration and testing of new builds before broader deployment.
Android banking trojan family whose share among detected banker samples increased sharply; the report suggests its operators are actively producing many new variants, likely to test new functionality or evade defenses.
Mobile banking trojan family whose share among discovered banking samples increased significantly, suggesting active iteration and testing of new builds before broader deployment.
Mobile banking trojan family mentioned among active banker threats.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.