logo

Android Marcher now posing as Super Mario Run

ID: 079fa3c7-a764-5994-98ce-cf920c555eaa

STIX ID: report--079fa3c7-a764-5994-98ce-cf920c555eaa

Feed Name: Zscaler Security Research Blog

Threat Score
72/100

Date Published: 2025-04-02

Date Updated: 2026-05-01

...
...

Android Marcher banking malware is being distributed as a fake "Super Mario Run" Android app; upon installation it requests elevated permissions and displays fraudulent overlay pages (including fake banking and credit-card forms) to harvest credentials. The report includes indicators (package name uiq.pizfbwzbvxmtkmtbhnijdsrhdixqwd, MD5 d332560f1fc3e6dc58d94d6fa0dab748), a list of targeted banking apps, C&C details, observed obfuscation, and visible errors suggesting the variant may be under development.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.