Vultur Android Banking Trojan Returns with Upgraded Remote Control Capabilities

The report describes the resurgence of the Android banking trojan Vultur, which now uses encrypted C2 communications, multiple on-the-fly decrypted payloads, enhanced anti-analysis and evasion techniques, and expanded remote-control capabilities via Android accessibility services; it is distributed through trojanized Play Store dropper apps and telephone-oriented attack delivery (TOAD). The article contextualizes Vultur alongside other active Android banking threats (Octo/Coper and MaaS campaigns), cites infection scale for related campaigns, and notes mitigations such as Google Play Protect.