Hundreds of Android banking and crypto apps hit by dangerous new Rokarolla malware

Date:
Wed, 17 Jun 2026 15:25:00 +0000

Description:
A new Android trojan is capable of stealing data from 217 banking and cryptocurrency apps.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Zimperium finds new Android banking trojan Rokarolla targeting 217 banking/crypto apps Distributed via spoofed sites, thirdparty stores, and social media; dropper masquerades as Google Play Protect Steals credentials via invisible overlays, hides itself, and adds extra spying features like keystroke logging, call blocking, and screen recording Security researchers Zimperium discovered Rokarolla, a powerful Android banking trojan capable of stealing login credentials and other valuable information from more than 200 banking and crypto
applications.

Rokarolla is being distributed through standalone (spoofed) websites, third-party app stores, and social media. It was not found on the Google Play Store or other official Android repositories. These malicious websites are advertising Google Chrome and TikTok apps, but when users download them, they first get a dropper that pretends to be Androids built-in anti-malware solution Google Play Protect. This dropper then offers Chrome and TikTok, laden with malware . Latest Videos From Watch full video here: How to spot Rokarolla Upon installation, Rokarolla will do what most banking trojans do - ask for extensive permissions, including the Accessibility service
permissions which are the usual malware red flag.

Other permissions that should be cause for concern include access to SMS and calls, as well as access to notifications. You may like This devious Android malware has returned disguised as TikTok or streaming apps Android Trojans
use a devious trick and 'magically' disappear once installed SparkCat malware returns to target Android and iOS users, hiding in innocent apps to try and steal your details

If the victims grant all these permissions, Rokarolla will first profile the device and scan it for one of 217 banking and crypto apps.

After that, whenever the user brings up one of those apps, Rokarolla will display an invisible overlay to capture the login credentials, as well as PIN codes and unlock patterns. The trojan has numerous tricks up its sleeve to avoid scrutiny and remain hidden, including displaying fake installation screens, hiding the application icon from the app drawer, silencing audio and vibrations, and keeping the screen awake. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

It can also extract contact information and WhatsApp contacts, grab keystrokes, record the screen, block incoming calls, and send screenshots.

Usually, banking trojans like Rokarolla target specific geographies and languages. Zimperium did not say which parts of the world were most at risk, or how many people were possibly infected. Those who only download apps from official repositories such as the Google Play Store or Galaxy Store are not
at risk.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/hundreds-of-android-banking-and-crypto- apps-hit-by-dangerous-new-rokarolla-malware


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)