Over 800 Android Apps Targeted in PIN-Stealing Trojan Campaign

### Executive summary Zimperium zLabs reports four parallel Android banking-trojan campaigns that together target over 800 banking, cryptocurrency, and social apps by abusing Accessibility Services and overlay permissions to capture PINs, deploy fake screens, monitor interactions, and persist on devices; infection vectors include phishing, homograph domains, and sideloaded fake or cloned apps using the Native Session Installation API to bypass restrictions. The malware families use multi-stage droppers, non-interactive overlays to hide permission grants, and uninstall-resistance techniques to enable real-time credential and 2FA theft and potential account or device takeover; recommended mitigations are avoiding sideloading, reviewing/revoking Accessibility and overlay permissions, and using mobile anti-malware solutions.