Android Banking Trojan Linked to Cambodia Scam Compounds Hits 21 Countries

**Executive Summary:** Infoblox Threat Intel (with Chong Lua Dao) links a Southeast Asian forced‑labour scam compound in Cambodia to an Android banking trojan used across 21 countries; attackers deploy dozens of fake domains to distribute malicious sideloaded apps, operate a malware‑as‑a‑service model, and use trafficked workers to run distribution and social engineering, while the trojan intercepts SMS, bypasses biometric checks, overlays banking apps, and enables real‑time fraudulent transactions—reportedly affecting victims in Southeast Asia, Europe, and Latin America and including technical IOCs and mitigation recommendations.