Sturnus Banking Malware Steals Communications from Signal and WhatsApp, Gaining Full Control of The Device

Sturnus is a sophisticated Android banking trojan observed in early targeted campaigns in Southern and Central Europe that uses convincing overlay login screens to steal banking credentials and can capture decrypted messages from apps like WhatsApp, Telegram, and Signal by reading the device screen. It provides full remote device takeover (including SMS injection and screen blackout) and uses a layered communication protocol combining plaintext, RSA, and AES over WebSocket/HTTP; researchers report limited samples and intermittent campaigns consistent with an evaluation/tuning phase.