GMBot: Android poor man’s “webinjects”

The report analyzes GMBot, a mobile banking trojan for Android that uses dynamic application overlays and WebView HTML snippets to impersonate banking and messaging apps, enabling credential and credit-card phishing as well as SMS-based OTP interception; it details targeted apps recovered from older source code, capabilities such as device-administrator abuse and locale checks to avoid Russian victims, and provides three sample hashes as indicators.