Fabricated Bank Website Distributes Android Spyware: Protect Yourself

Cyble Research & Intelligence Labs describes a phishing campaign that lures imToken users to download a malicious IMTBANK APK (SpyMax variant). The malware abuses Android Accessibility and numerous permissions to persist, capture screenshots, steal 2FA codes, SMS, contacts, location and other sensitive data, communicating with C2 servers; the report includes APK hashes and phishing/C2 URLs and offers remediation and detection recommendations.