BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain

McAfee Mobile Research documents BRATA, an Android banking trojan distributed via Google Play that poses as security scanners to trick users into granting accessibility permissions; once installed it can capture PINs, keylog, record screens, display phishing pages for financial apps (targets in Brazil, Spain, USA), and uses obfuscation, remote payloads, and commercial packers to evade analysis. The report provides IoCs (SHA256 hashes, package names, malicious domains), details of capabilities and attack flow, and recommended defenses.