HookBot Malware’s Overlay Attacks To Impersonate As Popular Brands

NetCraft researchers describe HookBot, an evolving Android banking Trojan distributed via malicious apps on unofficial stores and Telegram that uses overlay attacks to impersonate trusted apps and steal credentials through keylogging, screen capture, and SMS interception; the malware features a builder tool for low-skill operators, obfuscation to hinder analysis, C2-driven HTML overlays for rapid updates, and worm-like propagation via automated WhatsApp messages.