Threat Advisory: BlackRock Mobile Malware

## Executive summary BlackRock is an Android-based credential- and card-stealing malware family (derived from Xeres) disclosed in July 2020 that delivers malicious payloads via seemingly useful utility apps, escalates privileges using Accessibility Service and fake update dialogs, then displays overlay phishing screens and captures SMS to harvest login credentials and credit card data from 337 targeted apps across banking, shopping, communication, and other categories; the advisory describes its infection chain, targets, detection by Zimperium, and recommended defenses.