New Android Banking Malware ‘DeVixor’ Adds Ransomware Capabilities

Cyble researchers detail deVixor, an evolving Android banking RAT targeting Iranian users via phishing APKs that combines credential theft, banking overlays, keylogging, notification harvesting, persistence and a remotely-triggered ransomware module; it uses Firebase and a Telegram bot infrastructure for scalable C2 and administration and has been observed across 700+ samples, indicating an active, maintained criminal service.