BankBot & Friends: Phishing Mobile Customers Like You Soon

This report describes BankBot-family Android banking trojans that are distributed via seemingly legitimate apps, enumerate installed banking apps, contact a C2 to retrieve overlay content, and display fake login screens over legitimate banking apps to phish credentials; the malware initially targeted ~20 apps, expanded to 150+ banks across 27 countries, and recent variants target Polish banks disguised as 'Crypto Monitor' and 'StorySaver'. It also notes detection capabilities provided by Zimperium's z9 and zIAP solutions.