Rokarolla Banking Trojan Targets 200 Applications
New Android banking trojan Rokarolla targets over 200 financial apps, stealing credentials and data.
A new Android banking trojan named Rokarolla has been identified by Zimperium, capable of targeting over 200 cryptocurrency and banking applications. Distributed via malicious websites disguised as popular apps, Rokarolla requests extensive permissions, including lockscreen credentials, and can steal data from 217 financial apps using screen overlays. It also harvests contacts, exfiltrates SMS, hijacks calls, functions as a keylogger, manipulates the clipboard, and captures screenshots, while employing evasion techniques like hiding its icon and disabling Google Play Protect.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Zimperium?
Get an email when a new story names Zimperium, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Rokarolla banking trojan exploits users' tendency to download apps from unofficial sources, bypassing the security vetting of official app stores like Google Play. Once installed, it abuses Android's permission model by requesting excessive privileges — including lockscreen credentials and accessibility services — that enable full device compromise. The malware's ability to disable Google Play Protect and hide its own icon demonstrates how attackers actively undermine built-in defenses to maintain persistence. This matters because it silently exfiltrates banking credentials, SMS (including OTPs), clipboard content, and contact data from over 200 financial applications, enabling large-scale financial fraud with minimal user awareness.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Rokarolla