Godfather Trojan – mobile banking malware that is impossible to refuse

**Godfather** is an actively used Android banking Trojan (an Anubis fork) that targets over 400 international financial services—including banks, crypto wallets, and exchanges—by overlaying web fakes, exfiltrating credentials, notifications, and OTPs, and supporting modules such as VNC, keylogger, screen recording, SOCKS5 proxy, and WebSocket remote control; it is distributed via decoy apps (including Google Play) and Malware-as-a-Service channels, and the report includes multiple IoCs (domains, APK hashes, Telegram channels) and mitigation guidance.