Loading story…
Group-IB reported on the Godfather Android banking trojan, a malware strain designed to compromise mobile banking users by stealing credentials and other sensitive financial data from infected devices. The trojan is associated with attacks against banking and cryptocurrency applications, using Android-focused infection and evasion techniques to gain access to victims’ accounts and facilitate fraud.
The report highlights Godfather as part of the continuing threat posed by mobile banking malware, with operators adapting their tooling to target financial apps and harvest authentication data at scale. The activity underscores the risk to organizations and consumers relying on Android devices for financial services, particularly where malware can abuse accessibility features, overlay attacks, or other device permissions to intercept user input and bypass normal security controls.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Group-IB published a blog post detailing the Godfather Android banking Trojan. No additional incident dates or prior milestones are provided in the reference content.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Godfather** Android banking trojan has been documented as an active mobile threat that steals financial, identity, and personal data from Android users through extensive device surveillance and account-takeover features. Technical reporting describes the malware abusing Android accessibility services for keylogging and screen interaction monitoring, while also stealing SMS messages and notifications to intercept authentication flows and bypass **2FA**. Researchers said the malware also supports **VNC-style remote control**, proxying, and command-and-control communications, giving operators broad visibility into infected devices and the ability to manipulate sessions tied to banking and other sensitive apps. Analysis of the malware shows Godfather relying on runtime string decryption with **Blowfish**, dynamically retrieving targeted application lists from its C2 infrastructure, and obtaining C2 details from a **Telegram account description** to complicate tracking and takedown efforts. Reporting cited prior observations that the trojan targeted more than **400 financial organizations** between 2021 and 2022, with renewed campaigns focusing heavily on **Turkey** and using fake music applications as an infection vector. Reverse-engineering materials and public research repositories have since published notes, slides, code, and marked-up samples to help defenders better understand the malware's behavior and detection opportunities.
Aug 15, 2026
Researchers reported that the **GodFather** Android malware is being delivered through a multistage dropper that hides its payload with ZIP header tampering, fake encryption flags, string obfuscation, dead code, and dynamic DEX loading. In the analyzed sample (`SHA-256: 49002e994539fa11eab6b7a273cf90272dda43aa3dd9784fde4c23bf3645fdcb`), the app `com.metaprescutal.systematist` extracts an embedded asset containing two encrypted DEX files, decrypts them with a hardcoded DES key, and displays a Turkish-language lure to persuade victims to allow installation of unknown apps. It then side-loads `umbras.apk` as package `com.heb.reb` using the Android `PackageInstaller` session API and launches the installed GodFather core component. The campaign shows how mobile malware operators are combining layered droppers with **virtualization-style abuse** and Android permission workarounds to defeat platform protections and increase fraud potential. By installing the payload through session-based mechanisms, the malware is designed to bypass Android 13 **Restricted Settings** barriers that normally hinder side-loaded apps from gaining sensitive access; once active, the GodFather core seeks **Accessibility Service** privileges to enable spyware and banking trojan behavior. The broader research warns that this tradecraft turns legitimate mobile app environments into an attacker-controlled execution space, complicating detection for defenders and raising the risk of credential theft and on-device account takeover.
Aug 14, 2026
Multiple new Android malware campaigns have been identified targeting users' financial data and payment methods. Researchers uncovered advanced banking trojans such as BankBot-YNRK and DeliveryRAT, which harvest sensitive information from compromised devices and employ sophisticated evasion techniques, including emulator detection and device-specific targeting. These trojans often masquerade as legitimate apps, such as Indonesia's digital ID application, and can mute device notifications to avoid detection by victims. In addition, a next-generation Android banking trojan has been observed hiding within digital ID apps, automating the theft of cryptocurrency wallets and evading analysis environments. A separate large-scale scam involves over 760 malicious Android apps exploiting NFC and HCE technologies to steal payment card data globally. These apps facilitate unauthorized transactions by leveraging contactless payment features. The surge in Android-targeted financial malware highlights the growing risk to users' banking credentials, payment cards, and cryptocurrency assets, with attackers employing increasingly sophisticated methods to bypass security controls and evade user awareness.
Jun 29, 2026