InfoSecBulletin Cybersecurity for mankind
A new Android banking trojan called deVixor poses a serious risk to mobile users, featuring financial data theft, device surveillance, and ransomware in one malicious tool.
The malware, active since October 2025, is a significant threat to Android users, luring victims with fake car websites and using Telegram for control.
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
The malware spreads through fake websites pretending to be real car businesses, attracting victims with low-priced vehicle deals.
Cyble Research and Intelligence Lab (CRIL) analyzed over 700 samples and found a widespread infection campaign by threat actors using misleading distribution techniques.
The campaign uses advanced social engineering, with fake domains like asankhodroo[.]shop, asan-khodro.store, and naftyar.info spreading malware.
Evidence shows that the operation targets Iranian users, indicated by language used in Telegram messages, Persian phishing schemes, and a focus on Iranian banks and local cryptocurrency exchanges, highlighting the regional threat.
The malware gathers financial data from SMS by scanning up to 5,000 messages for OTPs, account balances, card numbers, and messages from banks and crypto exchanges.
The trojan specifically targets 26 Iranian banks like Bank Melli Iran, Bank Mellat, Bank Tejarat, and Bank Saderat Iran, as well as 14 cryptocurrency exchanges including Binance, CoinEx, Ramzinex, and Exir.
deVixor uses WebView-based JavaScript injection attacks to steal banking credentials, in addition to SMS harvesting.
deVixor has a troubling feature: it can trigger ransomware remotely. When attackers use the “RANSOMWARE” command, it locks the victim’s device and shows a message demanding cryptocurrency for release.
Based on screenshots shared on the threat actor’s Telegram channel, victims see a message stating “Your device is locked. Deposit to unlock” along with a TRON cryptocurrency wallet address and a demand of 50 TRX tokens.
The latest versions support over 50 commands for total device control, including keystroke capture, screenshot collection, notification access, contact extraction, gallery access, and app disguise.
Version 2 introduced additional commands such as SEARCH_ALL_SMS for keyword-based message searching, NOTIFICATION_READER for collecting device notifications, and GET_ALL_SENT_SMS for exfiltrating sent message history.
