Datzbro Android Trojan Uses Senior Travel Scams to Enable Device Takeover and Financial Fraud
Summary
ThreatFabric analyzed Datzbro, an Android Trojan distributed through fake senior-event promotions. Its remote control, overlays, keylogging, and credential theft capabilities can enable financial fraud; researchers also found a leaked C2 application and builder.
Key points
- Fake Facebook groups promoted senior trips and events in Australia and other countries; victims were reportedly contacted through Messenger or WhatsApp and directed to malicious app downloads.
- Google Play download buttons on the fake event sites delivered a malicious APK; researchers also observed distribution using the Zombinder dropper.
- Datzbro can remotely control infected devices, stream screens, use Accessibility Services, manage files and photos, and capture audio and video.
- A customizable black overlay can conceal the operator’s activity from the device user while allowing remote interaction.
- The Trojan can prompt for credentials and PINs and filter Accessibility events for banking, payment, crypto, password, and verification terms.
- Researchers found a leaked desktop C2 application and builder; they hypothesize that the malware is being distributed freely among cybercriminals.
Article Details
- Attack Vectors
- Fraudsters used Facebook groups promoting senior activities to attract victims, then contacted them through Messenger or WhatsApp with links to download a purported community application.
- Clicking the fake website's “Google Play” button downloaded a malicious APK containing Datzbro; in some cases, the Zombinder dropper was used to bypass Android 13+ restrictions.
- Some victims were asked to pay sign-up fees on the same websites, leading to phishing and card-detail theft.
- Datzbro used Accessibility Services for remote device control, keylogging, credential theft, and hiding fraudulent interactions with a black overlay.
- Defensive Notes
- Warn users, especially seniors, to be cautious of unsolicited event invitations and application-download links received through social media or messaging services.
- Verify event registration applications and payment requests through trusted sources before installing applications or entering credentials or payment details.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 453b0a62e414e9b40185c63842546fc96e8e1ab3f77d3230b02988dd8834c555 | SHA-256 hash listed in the article's Indicators of Compromise section for a Datzbro campaign application named Lively Years. |
| SHA256 | a57d70b2873d9a3672eda76733c5b2fb96dca502958064fab742cfc074bf0feb | SHA-256 hash listed in the article's Indicators of Compromise section for a Datzbro campaign application named Senior Group. |
| SHA256 | ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb | SHA-256 hash listed in the article's Indicators of Compromise section for a Datzbro campaign application named ActiveSenior. |
| SHA256 | fac119c569ba7dd19df9154f22f928cf3f0b0165bbe7d6b11a77215bdfc2a11a | SHA-256 hash listed in the article's Indicators of Compromise section for a Datzbro campaign application named DanceWave. |
MITRE ATT&CK
T1411Datzbro could request service passwords through fake activities and capture them from victims.T1417.001Datzbro's Accessibility-based keylogging could capture credentials entered into mobile banking applications.T1429Datzbro could capture device audio and video using the microphone and camera.T1437Datzbro provided remote-control and device-management functionality on infected Android devices.T1456The campaign used fake senior-activity groups and event-registration lures to persuade victims to install a malicious Android application.T1476Victims were directed to install Datzbro from a fake community-application website.T1512Datzbro could manage files on infected devices, including reading and uploading files.T1513Datzbro's black overlay hid the operator's fraudulent activity from the device user.T1517Datzbro's photo-stealing functionality could list albums and upload photos from infected devices.T1636.002Datzbro could manage contacts, including adding, updating, and deleting contact records.T1636.003Datzbro's SMS management commands could list, send, delete, and query messages.
Malware
DatzbroMoreover, a new Device-Takeover Android Trojan, which we named “Datzbro”, was discovered as part of the campaign.ZombinderDuring our research, we observed cases where Datzbro was directly installed on devices, as well as cases where a dropper bypassing Android 13+ restrictions - namely Zombinder - was used.
Products
AlipayAlipay (com.eg.android.AlipayGphone)AndroidMoreover, a new Device-Takeover Android Trojan, which we named “Datzbro”, was discovered as part of the campaign.FacebookUsers reported scammers managing Facebook groups promoting “active senior trips.” ThreatFabric researchers analyzed the campaign and identified several groups, managed by fraudsters, targeting various regions and usingWeChatWeChat (com.tencent.mm)
Countries
AustraliaIn August 2025, multiple scam alerts were issued in Australia.CanadaWe found that not only Australia was targeted, but also users in Singapore, Malaysia, Canada, South Africa, and the UK.MalaysiaWe found that not only Australia was targeted, but also users in Singapore, Malaysia, Canada, South Africa, and the UK.SingaporeWe found that not only Australia was targeted, but also users in Singapore, Malaysia, Canada, South Africa, and the UK.South AfricaWe found that not only Australia was targeted, but also users in Singapore, Malaysia, Canada, South Africa, and the UK.United KingdomWe found that not only Australia was targeted, but also users in Singapore, Malaysia, Canada, South Africa, and the UK.