New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds

Zimperium's zLabs documented 'Rokarolla', a sophisticated Android banking trojan distributed via fake app websites and a dropper disguised as Google Play Protect; it abuses Accessibility permissions to disable Play Protect, install payloads, capture lock-screen credentials, present HTML overlays to harvest logins and card data, intercept and send SMS (including OTPs), rewrite the clipboard to hijack crypto payments, take stealthy screenshots, and supports 137 remote commands with multiple fallback C2s—indicators and detections are published by Zimperium.