OverlayPhantom Android Trojan Uses Accessibility Abuse to Steal Banking Credentials
Summary
Cyble researchers detail OverlayPhantom, an Android banking trojan distributed through app-impersonating URLs. It abuses Accessibility Service, targets more than 180 financial apps in 10 countries, steals credentials through overlays and streams screens to operators.
Key points
- Cyble’s CRIL reports that OverlayPhantom has been active since early May 2025 and is distributed through malicious URLs using ID Austria and TikTok lures.
- A dropper displays a fake Google Play update and guides users to enable Accessibility Service; the payload then masquerades as Google Play Services.
- The malware checks foreground apps against a hardcoded target list and displays embedded WebView phishing pages to collect usernames, passwords, and card details.
- CRIL found targeting for more than 180 banking, financial, and cryptocurrency apps across 10 countries.
- OverlayPhantom supports more than 30 remote commands, including gestures, clipboard changes, device locking, and credential-collection overlays.
- Its C2 uses ports 9091 for commands, 9092 for device status, and 9090 for screen streaming.
- The malware uses Android’s MediaProjection API to capture and stream screen frames as JPEGs, giving operators near-real-time screen visibility.
Article Details
- Attack Vectors
- Malicious URLs distribute a dropper impersonating ID Austria and TikTok; the dropper presents a fake Google Play update to persuade victims to install the payload.
- The payload masquerades as Google Play Services and prompts victims to enable Android Accessibility Service permissions.
- The malware checks foreground apps against a hardcoded target list and displays embedded HTML phishing pages as overlays to steal usernames, passwords, and payment card details.
- OverlayPhantom uses Accessibility Service capabilities for remote gestures, clipboard manipulation, screen locking, fake notifications, and other device control.
- The malware captures and streams screen frames as JPEG over TCP to its C2 server, and sends stolen data to that server over its C2 channels.
- Defensive Notes
- Install apps only from trusted official sources; avoid app-installation links received through SMS, social media, or email.
- Verify an app’s legitimacy before installing it or granting permissions, especially Accessibility Service permissions.
- Verify URLs and avoid suspicious links or websites requesting sensitive information.
- Enable multi-factor authentication for banking and financial apps.
- Report suspected infection or targeting to the bank and local authorities; reset credentials and factory-reset the device if necessary.
- Use a mobile security application with real-time scanning and keep Android and apps updated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 199[.]217[.]99[.]122 | OverlayPhantom command-and-control server used for device communications and screen streaming. |
| SHA256 | 8ddc1f2a75f3d5b5bd054a5367bd5015ebc90f3453d63c7cce438c12dc2ae86a | SHA-256 hash of an OverlayPhantom sample observed in the analysis. |
| SHA256 | 9ef37376bfaa18e193cc72218924ad8ebf56d2667d348f0eae5ae6ec45ab8775 | SHA-256 hash of an OverlayPhantom sample observed in the analysis. |
| SHA256 | f8b614a2918378063d6e6655b676ceb52ae65b1510e2cc08087fcac31acb7aeb | SHA-256 hash of an OverlayPhantom sample observed in the analysis. |
| URL | hxxps[:]//bitlrewards-app[.]com/api/download/IDAustria | Malicious distribution URL used to deliver the OverlayPhantom APK impersonating ID Austria. |
MITRE ATT&CK
T1406The malware uses obfuscated strings.T1418The malware checks installed applications against a hardcoded target list before displaying phishing overlays.T1437The malware communicates with its C2 over TCP-based socket connections.T1453OverlayPhantom abuses Android Accessibility Service to monitor activity and control the infected device.T1509OverlayPhantom uses dedicated non-standard C2 ports 9090, 9091, and 9092.T1513OverlayPhantom captures the device screen using Android’s MediaProjection API and streams JPEG frames.T1624.001The article reports that OverlayPhantom implements a broadcast receiver for screen capturing.T1628.001OverlayPhantom hides its application icon to make detection and removal harder.T1646The malware sends harvested credentials and other stolen data to its C2 server.T1655.001The payload masquerades as Google Play Services.T1660OverlayPhantom is distributed through phishing sites and malicious URLs that impersonate trusted applications.
Malware
Products
AndroidCyble’s CRIL identified OverlayPhantom, a new Android banking trojan distributed through malicious URLs that impersonate trusted apps such as ID Austria and TikTok.Google Play ServicesIt masquerades as “Google Play Services” and abuses Android Accessibility Service for persistent control over infected devices.ID AustriaCyble’s CRIL identified OverlayPhantom, a new Android banking trojan distributed through malicious URLs that impersonate trusted apps such as ID Austria and TikTok.TikTokCyble’s CRIL identified OverlayPhantom, a new Android banking trojan distributed through malicious URLs that impersonate trusted apps such as ID Austria and TikTok.
Countries
Australiafinancial services, and cryptocurrency platforms, spanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.Belgiumplatforms, spanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.Finlandplatforms, spanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.Franceand cryptocurrency platforms, spanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.Germanyservices, and cryptocurrency platforms, spanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.Italy10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.Netherlandsspanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.Spainincluding the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.United KingdomUnited States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.United Statesbanking, financial services, and cryptocurrency platforms, spanning 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom.
Industries
BankingCyble’s CRIL identified OverlayPhantom, a new Android banking trojan distributed through malicious URLs that impersonate trusted apps such as ID Austria and TikTok.CryptocurrencyOverlayPhantom targets more than 180 banking, financial, and cryptocurrency apps across 10 countries.Financial ServicesOverlayPhantom, active since May 2025, targets over 180 applications across banking, financial services, and cryptocurrency platforms, spanning 10 countries, including the United States, Australia, Germany, France,