InfoSecBulletin Cybersecurity for mankind
A new Android banking trojan called deVixor poses a serious risk to mobile users, featuring financial data theft, device surveillance, and ransomware in one malicious tool.
The malware, active since October 2025, is a significant threat to Android users, luring victims with fake car websites and using Telegram for control.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The malware spreads through fake websites pretending to be real car businesses, attracting victims with low-priced vehicle deals.
Cyble Research and Intelligence Lab (CRIL) analyzed over 700 samples and found a widespread infection campaign by threat actors using misleading distribution techniques.
The campaign uses advanced social engineering, with fake domains like asankhodroo[.]shop, asan-khodro.store, and naftyar.info spreading malware.
Evidence shows that the operation targets Iranian users, indicated by language used in Telegram messages, Persian phishing schemes, and a focus on Iranian banks and local cryptocurrency exchanges, highlighting the regional threat.
The malware gathers financial data from SMS by scanning up to 5,000 messages for OTPs, account balances, card numbers, and messages from banks and crypto exchanges.
The trojan specifically targets 26 Iranian banks like Bank Melli Iran, Bank Mellat, Bank Tejarat, and Bank Saderat Iran, as well as 14 cryptocurrency exchanges including Binance, CoinEx, Ramzinex, and Exir.
deVixor uses WebView-based JavaScript injection attacks to steal banking credentials, in addition to SMS harvesting.
deVixor has a troubling feature: it can trigger ransomware remotely. When attackers use the “RANSOMWARE” command, it locks the victim’s device and shows a message demanding cryptocurrency for release.
Based on screenshots shared on the threat actor’s Telegram channel, victims see a message stating “Your device is locked. Deposit to unlock” along with a TRON cryptocurrency wallet address and a demand of 50 TRX tokens.
The latest versions support over 50 commands for total device control, including keystroke capture, screenshot collection, notification access, contact extraction, gallery access, and app disguise.
Version 2 introduced additional commands such as SEARCH_ALL_SMS for keyword-based message searching, NOTIFICATION_READER for collecting device notifications, and GET_ALL_SENT_SMS for exfiltrating sent message history.
