Insights, news, education and announcements from PolySwarm | mobile banking fraud

Beyond Banking Trojans: Rokarolla Expands the Android Fraud Playbook

Jun 26, 2026 2:32:36 PM / by The Hivemind posted in Threat Bulletin, Android Malware, Android banking trojan, mobile banking fraud, cryptocurrency malware, Rokarolla, banking malware, Android phishing overlays

Verticals Targeted: Financial, Cryptocurrency
Regions Targeted: Global
Related Families: Rokarolla

Executive Summary

Researchers have identified Rokarolla, a newly discovered Android banking trojan distributed through malicious websites impersonating trusted applications such as TikTok, Google Chrome, and Google Play Protect. The malware targets at least 217 banking and cryptocurrency applications and leverages Android Accessibility Services, phishing overlays, SMS interception, keylogging, screen monitoring, and call blocking to facilitate financial fraud. Rokarolla exposes at least 137 operator commands and employs multiple persistence and evasion mechanisms, allowing attackers to maintain extensive control over infected devices while minimizing user awareness and intervention.

Read More

Massiv Android Banking Trojan

Feb 23, 2026 2:39:35 PM / by The Hivemind posted in Threat Bulletin, device takeover, Android banking trojan, Android Overlay Attacks, IPTV masquerade, mobile banking fraud, remote control Android, Massiv malware, southern Europe threats

Verticals Targeted: Financial, Government
Regions Targeted: Southern Europe
Related Families: None

Executive Summary

Massiv represents an emerging Android banking Trojan family capable of overlay-based credential theft, keylogging, message interception, and full device takeover via remote control features, enabling fraudulent transactions and account manipulations. Distributed primarily through fake IPTV applications sideloaded outside official stores, it has facilitated confirmed fraud in southern Europe, particularly exploiting Portuguese government digital identity tools for bypassing security verifications.

Read More