GodFather Banking Trojan Debuts Virtualization Tactic

Zimperium zLabs has reported that the GodFather Android banking Trojan has evolved to use on-device virtualization: a malicious host app installs a controlled sandbox and runs legitimate banking and crypto apps inside it, allowing real-time interception of credentials and bypassing security checks; the campaign currently targets a dozen Turkish financial institutions while scanning hundreds of apps globally, includes advanced evasion (ZIP manipulation, Java-layer code), and comes with published MITRE ATT&CK mappings and IOCs to support detection and response.