Iranian Mobile Banking Malware Campaign Threat Continues

Zimperium uncovered 245 new variants of an Iranian mobile banking malware campaign (28 of which were undetected) that harvests banking credentials, credit card data, and OTPs via accessibility-service overlays and phishing webviews; operators use GitHub and intermediate C2s to distribute active phishing URLs and exfiltrate stolen data to Telegram channels, with vendor-specific evasion for Xiaomi/Samsung and potential expansion to crypto wallets and iOS.