FvncBot Targets Android Users, Exploiting Accessibility Services for Attacks

## Executive summary FvncBot is a newly observed Android banking trojan disguised as an mBank security app that leverages Accessibility Services to perform credential theft (keylogging, web‑inject overlays), remote UI inspection (HVNC/text‑mode UI tree), and H.264 screen streaming; it uses unencrypted HTTP/JSON for exfiltration and FCM plus an embedded Fast Reverse Proxy WebSocket for real‑time control. The campaign is currently focused on Polish users (call_pl build), the malware is obfuscated with APK0day, and observable indicators include the package name com.fvnc.app and C2 traffic to naleymilva.it.com.