PixPirate Android malware uses new tactic to hide on phones

PixPirate is an Android banking trojan targeting Brazilian Pix users that uses a downloader/droppee two-app design to remain hidden and persistent: the payload (droppee) intentionally omits a launcher icon and exposes an exported service that the downloader binds to in order to start malicious activity. The malware requests Accessibility permissions, can automate fraudulent Pix transfers and 2FA interception in the background, is distributed via APKs sent over WhatsApp/SMS, and can persist and launch on system events even if the initial downloader is removed.