Android malware uses VNC to give attackers hands-on access

Cleafy researchers detail Klopatra, a sophisticated Android banking trojan distributed via a fake IPTV/VPN APK that abuses Accessibility services to steal credentials, exfiltrate keystrokes/clipboard data, uninstall AV apps, and provide operators with a stealthy black‑screen VNC mode for manual bank fraud; ~3,000 infections in Europe and multiple active C2 builds point to an evolving Turkish-speaking criminal operation.