OverlayPhantom Android Banking Trojan Targets 180+ Financial Apps Across 10 Countries

OverlayPhantom is a sophisticated Android banking trojan active since May 2025 that spreads via malicious APKs impersonating trusted government and consumer apps; it abuses Android Accessibility Service to maintain persistent control, deploys visually convincing WebView phishing overlays to harvest credentials, and supports real-time screen streaming and over 30 remote commands to facilitate large-scale financial fraud across at least 10 countries.