Android Banking Malware deVixor Actively Targeting Users with Ransomware Capabilities.

deVixor is an actively maintained Android banking trojan and remote access tool observed since October 2025 that combines SMS and credential theft, WebView-injection overlays, keylogging, extensive use of Android Accessibility Service, and a remotely triggered ransomware lock (configured via LockTouch.json). The campaign spreads via counterfeit automotive websites delivering malicious APKs, uses Telegram and Firebase for command-and-control and operator administration, and targets Iranian financial institutions and cryptocurrency exchanges; researchers analyzed over 700 samples and identified domain-based IOCs and Telegram channels evidencing large-scale, sophisticated operations.