Loading story…
Security researchers reported that leaked source code for the Android banking malware GM Bot enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including Slempo, Bankosy, Acecard, and MazarBot—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans.
ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on Google Play. The newer malware, detected as Trojan.Android/Spy.Banker.HW, posed as World Weather, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than 2,800 infected devices, and the hosting provider removed the C2 server after notification.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
The Trojan.Android/Spy.Banker.HW sample remained on Google Play until February 20, 2017, when it was removed after ESET reported it. The app retained legitimate weather functionality while adding credential theft, SMS interception, and remote lock/unlock features.
ESET discovered a newer Android banking trojan variant masquerading as the legitimate app World Weather on Google Play. The sample, detected as Trojan.Android/Spy.Banker.HW, expanded targeting to 69 banking apps across Turkey, the UK, Germany, and Austria.
ESET found that the malware's command-and-control server had been active since February 2, 2017. The exposed control panel was accessible without credentials and provided visibility into more than 2,800 infected devices.
ESET said Dr.Web had analyzed an earlier malware variant that ESET detected as Android/Spy.Banker.HH starting on December 26, 2016. ESET noted that this sample belonged to the same malware family but was not directly tied to the later Google Play variants.
ESET reported that Android banking malware source code and accompanying C&C server code, including a web control panel, had been publicly available on a Russian forum since December 19, 2016. ESET concluded later Google Play banking trojans were built from this released code.
IBM said the Android banking malware GM Bot first appeared on Russian-speaking forums in late 2014. The malware was designed to steal banking credentials and SMS-based authentication codes from Android devices.
After ESET notified the hosting company, the provider took down the malware's command-and-control server. ESET had previously accessed the exposed panel and observed data from more than 2,800 infected bots.
After the source code leak, IBM said the malware's creators appear to have developed and sold a second GM Bot version on underground forums focused on financial fraud. This indicated continued commercialization of the malware family despite the leak.
IBM Trusteer analyst Limor Kessem wrote that a buyer of the GM Bot code apparently reposted an encrypted archive containing the malware source code on a forum in December. The password was then shared beyond the original audience, widening distribution of the code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026
Android banking malware has evolved into two dominant forms: sophisticated banking Trojans and fake banking apps built to steal **banking credentials**, **payment card data**, and SMS one-time passwords. ESET reported that Trojans including **BankBot**, **Anubis**, **Exobot**, and **MazarBot** use overlay attacks, intrusive permissions, persistence techniques, and in some cases abuse of Android Accessibility features to impersonate legitimate apps and facilitate account takeover and fraud. Fake banking apps use a simpler approach, posing directly as a bank or financial service and presenting fraudulent login screens immediately after installation to harvest credentials. The report said the leak of **BankBot** source code helped drive a surge in Android banking Trojan variants, while fake banking apps became increasingly prevalent as a lower-complexity but still effective theft method. It also highlighted a Trojanized **QRecorder** app distributed through **Google Play** that targeted banks in Germany, Poland, and the Czech Republic and was installed more than **10,000** times before removal. ESET concluded that although advanced Trojans are more invasive and technically capable, fake banking apps can be equally effective because victims who install them are highly likely to enter sensitive information.
Aug 14, 2026
**TeaBot** (also tracked as **Anatsa**) infected Android devices through smishing campaigns and trojanized apps, including fake media, delivery, and utility software such as VLC, DHL, UPS, TeaTV, and QR-code scanners. Researchers found the malware later reached users through Google Play droppers that displayed fake update prompts and fetched second-stage APKs from GitHub, extending distribution beyond SMS lures. Campaigns initially focused on European banks, especially in Spain, Germany, and Italy, before expanding to roughly 400 targeted applications spanning banking, cryptocurrency, wallet, insurance, and other financial services in additional regions including the United States, Russia, and Hong Kong. Once installed, TeaBot abused Android **Accessibility Services** to gain broad control of the device, then hid its icon, intercepted SMS messages, logged keystrokes, captured screens, enumerated installed apps, and launched overlay attacks to steal credentials and 2FA codes from targeted apps. Analysts said the malware dynamically decrypted and loaded additional payloads, used partially XOR-encrypted command-and-control traffic, and in some cases terminated selected processes, including security tools, to reduce detection. Reports tied some second-stage payload delivery to GitHub repositories and noted that malicious Play Store apps had accumulated significant downloads before being identified and removed.
Aug 15, 2026