Android Banking Malware deVixor Actively Targeting Users with Ransomware Capabilities

deVixor is an evolving Android banking RAT observed in 700+ samples since October 2025 that intercepts SMS messages and injects JavaScript into WebViews to harvest banking and crypto credentials, uses Firebase and a separate C2 plus Telegram infrastructure for control and updates, and includes a ransomware module that locks devices demanding 50 TRX; it is distributed via fake automotive sites offering malicious APKs and primarily targets Iranian banks and cryptocurrency platforms.