Android Banker malware goes social

Researchers discovered an Android banking Trojan masquerading as the Sberbank app that overlays legitimate apps to phish credentials, intercepts and exfiltrates SMS and call metadata, can send/place messages and calls via C2 commands, and uses device-administrator privileges and broadcast receivers to resist removal; targeted apps are configurable by the C2 and the malware displays fake login pages before showing a technical error to victims.