Rokarolla Android trojan targets banking and crypto users, enables device takeover

Zimperium discovered Rokarolla, an Android banking trojan distributed via malicious websites impersonating legitimate apps that targets 217 banking and cryptocurrency applications; it abuses Accessibility Services and permissions to deploy phishing overlays, exfiltrate SMS/contacts/credentials, perform keylogging and clipboard manipulation, capture screenshots, block calls, mute device audio, and receive 137 remote commands from C2 infrastructure—Zimperium published IoCs and a MITRE ATT&CK mapping.