Loading story…
The Godfather Android banking trojan has been documented as an active mobile threat that steals financial, identity, and personal data from Android users through extensive device surveillance and account-takeover features. Technical reporting describes the malware abusing Android accessibility services for keylogging and screen interaction monitoring, while also stealing SMS messages and notifications to intercept authentication flows and bypass 2FA. Researchers said the malware also supports VNC-style remote control, proxying, and command-and-control communications, giving operators broad visibility into infected devices and the ability to manipulate sessions tied to banking and other sensitive apps.
Analysis of the malware shows Godfather relying on runtime string decryption with Blowfish, dynamically retrieving targeted application lists from its C2 infrastructure, and obtaining C2 details from a Telegram account description to complicate tracking and takedown efforts. Reporting cited prior observations that the trojan targeted more than 400 financial organizations between 2021 and 2022, with renewed campaigns focusing heavily on Turkey and using fake music applications as an infection vector. Reverse-engineering materials and public research repositories have since published notes, slides, code, and marked-up samples to help defenders better understand the malware's behavior and detection opportunities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository was published containing notes, slides, code, and a marked-up sample for the Strange Loop 2023 talk 'Unmasking the Godfather.' The materials present a reverse-engineering walkthrough of the Godfather Android banking trojan.
Brandefense published a technical analysis describing Godfather's capabilities, including keylogging, accessibility-service abuse, SMS and notification theft, VNC access, proxying, and Telegram-based C2 discovery. The report also notes renewed activity over the prior nine months, especially in Turkey via fake music apps.
Brandefense cites Group-IB as observing Godfather activity targeting financial organizations through October 2022. This anchors the end of the previously reported campaign window.
Group-IB reported that the Godfather Android banking trojan targeted more than 400 international financial companies, including banks and cryptocurrency services, during this period. The report says affected targets included organizations in the US, Turkey, Spain, Canada, France, Germany, England, Italy, and Poland.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported on the **Godfather** Android banking trojan, a malware strain designed to compromise mobile banking users by stealing credentials and other sensitive financial data from infected devices. The trojan is associated with attacks against banking and cryptocurrency applications, using Android-focused infection and evasion techniques to gain access to victims’ accounts and facilitate fraud. The report highlights Godfather as part of the continuing threat posed by mobile banking malware, with operators adapting their tooling to target financial apps and harvest authentication data at scale. The activity underscores the risk to organizations and consumers relying on Android devices for financial services, particularly where malware can abuse accessibility features, overlay attacks, or other device permissions to intercept user input and bypass normal security controls.
Jul 12, 2026
Researchers reported that the **GodFather** Android malware is being delivered through a multistage dropper that hides its payload with ZIP header tampering, fake encryption flags, string obfuscation, dead code, and dynamic DEX loading. In the analyzed sample (`SHA-256: 49002e994539fa11eab6b7a273cf90272dda43aa3dd9784fde4c23bf3645fdcb`), the app `com.metaprescutal.systematist` extracts an embedded asset containing two encrypted DEX files, decrypts them with a hardcoded DES key, and displays a Turkish-language lure to persuade victims to allow installation of unknown apps. It then side-loads `umbras.apk` as package `com.heb.reb` using the Android `PackageInstaller` session API and launches the installed GodFather core component. The campaign shows how mobile malware operators are combining layered droppers with **virtualization-style abuse** and Android permission workarounds to defeat platform protections and increase fraud potential. By installing the payload through session-based mechanisms, the malware is designed to bypass Android 13 **Restricted Settings** barriers that normally hinder side-loaded apps from gaining sensitive access; once active, the GodFather core seeks **Accessibility Service** privileges to enable spyware and banking trojan behavior. The broader research warns that this tradecraft turns legitimate mobile app environments into an attacker-controlled execution space, complicating detection for defenders and raising the risk of credential theft and on-device account takeover.
Aug 14, 2026
Security researchers reported that leaked source code for the Android banking malware **GM Bot** enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including **Slempo**, **Bankosy**, **Acecard**, and **MazarBot**—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans. ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on **Google Play**. The newer malware, detected as `Trojan.Android/Spy.Banker.HW`, posed as **World Weather**, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than **2,800 infected devices**, and the hosting provider removed the C2 server after notification.
Aug 15, 2026