Rokarolla Android Banking Trojan Targets 217 Apps and Steals Credentials
Summary
Zimperium’s zLabs describes Rokarolla, an Android banking trojan that targets 217 banking and crypto apps. Fake-app droppers and Accessibility abuse enable credential and PIN theft, SMS interception, clipboard manipulation, and covert screenshots.
Key points
- Zimperium’s zLabs reports that Rokarolla targets 217 banking and cryptocurrency apps and has 137 remote commands.
- It spreads through malicious websites posing as popular apps; a fake Play Protect dropper helps install the payload and obtain Accessibility access.
- HTML overlays imitate banking and wallet login screens to capture credentials and card details; another overlay targets lock-screen PINs, patterns, and passwords.
- The malware can read, send, and block SMS, potentially intercepting banking one-time codes, and can block incoming calls.
- It can record keystrokes, take screenshots through Accessibility, and replace copied crypto wallet addresses.
- Rokarolla can disable Google Play Protect and use multiple fallback command-and-control domains.
- The article recommends installing apps only from Google Play, keeping Play Protect enabled, and treating unexpected Accessibility requests cautiously.
Article Details
- Attack Vectors
- Malicious websites distribute fake apps posing as TikTok and Chrome.
- A dropper disguises itself as Google Play Protect to install Rokarolla and obtain Accessibility access.
- Rokarolla uses fake HTML overlays to capture credentials and payment details from banking and wallet apps, and an Android lock-screen overlay to capture PINs, patterns, or passwords.
- The malware reads, sends, and blocks SMS messages to intercept banking one-time codes; it can also block incoming calls.
- Rokarolla silently replaces clipboard contents with attacker wallet addresses and captures screenshots through Accessibility.
- The malware uses multiple fallback command-and-control domains, but the article does not provide their values.
- Defensive Notes
- Install apps only from Google Play.
- Leave Google Play Protect enabled.
- Treat unexpected Accessibility permission requests as a red flag.
MITRE ATT&CK
T1417.001Rokarolla uses a keylogger to record what the user types.T1417.002Rokarolla overlays fake HTML login pages on banking and wallet apps to capture entered information, and uses a lock-screen overlay to capture PINs, patterns, or passwords.T1476Malicious websites distribute fake apps posing as TikTok and Chrome to deliver the Rokarolla dropper.T1478Victims install a dropper disguised as Google Play Protect, which installs the Rokarolla payload.T1513Rokarolla captures screenshots through Accessibility, compresses them to PNG, and sends them out one frame at a time.T1636.004Rokarolla reads SMS messages to obtain banking one-time codes.
Malware
Vendors
Products
AndroidZimperium’s zLabs has identified Rokarolla, a new Android banking trojan that targets 217 banking and cryptocurrency apps and uses 137 commands to gain deep control over infected devices.Google ChromeIt spreads through fake apps like TikTok and Chrome, abuses Accessibility and HTML overlays, and can steal credentials, SMS codes, lock-screen PINs, and crypto payments while disabling Google Play Protect.Google Play ProtectIt spreads through fake apps like TikTok and Chrome, abuses Accessibility and HTML overlays, and can steal credentials, SMS codes, lock-screen PINs, and crypto payments while disabling Google Play Protect.imagin#RokarollaTikTokIt spreads through fake apps like TikTok and Chrome, abuses Accessibility and HTML overlays, and can steal credentials, SMS codes, lock-screen PINs, and crypto payments while disabling Google Play Protect.
Industries
BankingZimperium’s zLabs has identified Rokarolla, a new Android banking trojan that targets 217 banking and cryptocurrency apps and uses 137 commands to gain deep control over infected devices.CryptocurrencyZimperium’s zLabs has identified Rokarolla, a new Android banking trojan that targets 217 banking and cryptocurrency apps and uses 137 commands to gain deep control over infected devices.