Rokarolla Android Banking Trojan Steals Financial Data
ID: bf67c14e-0841-50a1-95d9-5a20037b2c4b
STIX ID: report--bf67c14e-0841-50a1-95d9-5a20037b2c4b
Feed Name: securityonline.info
Threat Score
Rokarolla is an Android banking trojan that achieves full device takeover via Accessibility abuse and social-engineered installers; it hides itself, downloads phishing overlays tailored to 217 cryptocurrency and banking apps, intercepts SMS (bypassing 2FA), records keystrokes, captures and exfiltrates screenshots, and attempts to disable Play Protect—operators control victims via HTTPS C2 and a pseudo‑VNC snapshot mechanism.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.