Trusted Design

Trojan-Banker.AndroidOS.Faketoken follow-up

概要

December 19: Many mobile bankers can block a device in order to extort money from its user. But we have discovered a modification of the mobile banking Trojan Trojan-Banker.AndroidOS.Faketoken that went even further – it can encrypt user data. In addition to that, this modification is attacking more than 2,000 financial apps around the world. We have managed to detect several thousand Faketoken installation packages capable of encrypting data, the earliest of which dates back to July 2016. According to our information, the number of this banker’s victims exceeds 16,000 users in 27 countries, with most located in Russia, Ukraine, Germany and Thailand. Trojan-Banker.AndroidOS.Faketoken is distributed under the guise of various programs and games, often imitating Adobe Flash Player. Many others hashes available ... but could be other variants. Investigations in progress.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Android banking trojan as Flash Player and bypasses 2FA (score: 0.80)
• Banking Trojan infected dozens of Android apps worldwide (score: 0.79)
• Android banking malware masquerades as Flash Player (score: 0.79)
• A Look Into The New Strain Of BankBot (score: 0.78)
• Android Trojan GM Bot is evolving and targeting more than 50 banks worldwide (score: 0.75)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る