Android Malware Distributed Via Smishing

This report details an ongoing smishing campaign targeting BBVA customers that delivers a malicious Android app (“BBVA Protect”) which loads a phishing page in WebView, injects JavaScript to exfiltrate credentials and account balances, intercepts SMS (to bypass 2FA), and communicates with multiple C2 domains; the analysis provides APK hashes, permissions abused, behavioral indicators, and mitigation recommendations.