Rokarolla Android Trojan Targets 217 Banking and Crypto Apps
Summary
Zimperium reports that Rokarolla, an Android trojan, targets 217 banking and crypto apps. It spreads through fake Chrome and TikTok installers and uses overlays to steal credentials and control infected devices.
Key points
- Zimperium says Rokarolla is distributed through malicious websites offering fake Chrome or TikTok installers.
- The installer impersonates Google Play Protect and requests Accessibility, notification, SMS, and call permissions.
- The malware checks infected devices for 217 targeted banking and cryptocurrency apps, then downloads matching phishing overlays.
- Overlays can capture login and financial details, lock-screen PINs or patterns, and user input.
- Zimperium describes 137 commands, including stealing SMS and contacts, capturing keystrokes, taking screenshots, and blocking calls or bank alerts.
- Rokarolla can disable Google Play Protect and hide its app icon; Zimperium says it did not find the malware on Google Play.
- The article recommends avoiding untrusted APK downloads and exercising caution when granting Accessibility permissions.
Article Details
- Event Type
- Discovery and analysis of the Rokarolla Android banking trojan and its targeting campaign
- Impact
- Rokarolla targets 217 banking and cryptocurrency apps. It can steal credentials, financial information, SMS messages, contacts, and keystrokes; capture lock-screen PINs or patterns; and use overlays and other commands to conceal activity and control infected devices. The article says it is distributed through malicious websites offering fake Google Chrome or TikTok installers and was not found on Google Play.
Malware
Products
AndroidRokarolla is a new Android banking trojan that targets 217 banking and cryptocurrency apps and uses 137 commands to steal credentials, SMS data, contacts, and more.Google ChromeIt spreads through fake Google Chrome and TikTok installers, impersonates Google Play Protect, and gives attackers extensive control over infected devices.Google Play ProtectIt spreads through fake Google Chrome and TikTok installers, impersonates Google Play Protect, and gives attackers extensive control over infected devices.TikTokIt spreads through fake Google Chrome and TikTok installers, impersonates Google Play Protect, and gives attackers extensive control over infected devices.
Industries
BankingRokarolla is a new Android banking trojan that targets 217 banking and cryptocurrency apps and uses 137 commands to steal credentials, SMS data, contacts, and more.CryptocurrencyRokarolla is a new Android banking trojan that targets 217 banking and cryptocurrency apps and uses 137 commands to steal credentials, SMS data, contacts, and more.