Herodotus Android Banking Trojan Mimics Human Typing to Evade Detection
Summary
Researchers describe Herodotus, an Android banking Trojan active in Italy and Brazil. It uses remote control, overlays and SMS theft, and randomizes text-entry delays to imitate human behavior and potentially evade fraud detection.
Key points
- Herodotus is distributed through sideloaded applications; its dropper prompts victims to enable Android Accessibility Services.
- The Trojan uses overlays to steal credentials, intercepts SMS codes and enables remote control of infected devices.
- During remote sessions, it enters text character by character with randomized delays of 300–3,000 milliseconds to imitate human typing.
- Researchers observed campaigns targeting users in Italy and Brazil, and found overlay pages aimed at financial organizations in several other countries and crypto services.
- Analysis found shared code and strings with the Brokewell banking Trojan, though the reused module appears limited and incompatible with Herodotus’s communication protocol.
- Herodotus was advertised as Malware-as-a-Service while still in development; the article recommends layered fraud controls rather than relying mainly on input timing.
- A listed command-and-control domain is gj23j4jg[.]google-firebase[.]digital.
Article Details
- Attack Vectors
- Herodotus is distributed by side-loading; the report says this may involve SMiShing links that lead to a dropper download.
- The dropper installs and launches the payload, then directs victims to enable Accessibility Service access.
- Herodotus uses Accessibility Service features for remote control, credential-stealing overlays, SMS interception, and screen logging.
- Defensive Notes
- Use layered fraud controls that consider device environment as well as user behavior; randomized delays between text inputs may evade systems relying mainly on interaction timing.
- Behavioral systems that model individual user behavior may identify anomalies more effectively than systems that use rudimentary input-timing checks.
- Use malware detection capable of classifying the malware family and version.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gj23j4jg[.]google-firebase[.]digital | Herodotus C2 domain listed in the indicators table. |
| DOMAIN | google-firebase[.]digital | Domain used by Herodotus for C2 communication, with different subdomains observed. |
| SHA256 | 53ee40353e17d069b7b7783529edda968ad9ae25a0777f6a644b99551b412083 | SHA-256 hash listed for a Herodotus sample. |
MITRE ATT&CK
T1091 · Replication Through Removable MediaThe report says distribution is performed by side-loading.T1411Herodotus displays fake credential-request pages over targeted applications.T1412Herodotus intercepts SMS messages, including 2FA codes.T1417.001Herodotus uses Accessibility Service logging to intercept information displayed on the screen.T1430Herodotus collects the list of installed packages and sends it to its C2 server.T1434Operators remotely control infected devices using Accessibility Service actions such as taps, swipes, and text input.T1517Herodotus displays blocking overlays to hide activity and keep victims from seeing banking-app screens.T1566.002 · Spearphishing LinkThe report says distribution may involve SMiShing links leading to the dropper.T1620 · Reflective Code LoadingThe dropper installs the Herodotus payload on Android devices.T1622 · Debugger EvasionHerodotus randomizes delays between text-input events to mimic human behavior and evade behavior-based detection.
Threat Actors
Malware
BrokewellDespite the shared distribution infrastructure, these samples turned out to be closer to a different malware family previously discovered by ThreatFabric analysts – Brokewell.HerodotusNevertheless, the newly discovered malware, named Herodotus by its developers, does not seem to be a direct evolution of Brokewell, but a new threat with parts of Brokewell stitched together with original parts.HookDuring our usual monitoring activity of malicious distribution points, Mobile Threat Intelligence service observed unknown malicious samples distributed next to well-known malware variants like Hook and Octo.OctoDuring our usual monitoring activity of malicious distribution points, Mobile Threat Intelligence service observed unknown malicious samples distributed next to well-known malware variants like Hook and Octo.
Tools
Countries
BrazilActive campaigns observed in Italy and Brazil, involving Device-Takeover attacks by Herodotus.ItalyActive campaigns observed in Italy and Brazil, involving Device-Takeover attacks by Herodotus.PolandWhile not observing other active campaigns, MTI was able to obtain the overlay pages used by Herodotus targeting financial organisations in the US, Turkey, the UK, Poland as well as crypto wallets and exchanges.TurkeyWhile not observing other active campaigns, MTI was able to obtain the overlay pages used by Herodotus targeting financial organisations in the US, Turkey, the UK, Poland as well as crypto wallets and exchanges.