InfoSecBulletin Cybersecurity for mankind
A new Android banking Trojan called Herodotus has emerged recently. It is offered as Malware-as-a-Service (MaaS) and pretends to be a legitimate app to trick users into installing an APK. After installation, it requests sensitive permissions and can control the device for banking transactions. A modern mobile attack, yet once again, largely invisible to most traditional antivirus solutions.
Herodotus in brief:
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
The banking trojan spreads via SMS phishing links that lead users to a fake page where they are urged to download an app. The victim installs an APK that is not from the Play Store.
Herodotus, once installed and given permissions, asks for critical permissions like Accessibility. It overlays fake screens on real apps to trick users and can capture screens and keystrokes for session takeover while the victim is logged in.
Herodotus avoids detection by anti-fraud systems by adding random delays, subtle movements, and realistic typing patterns to its actions.
Why an antivirus isn’t enough:
The Pradeo team checked for malware in a top antivirus database, but no alerts were triggered for the application. This means the antivirus didn’t detect the malicious app, despite it being easily found through a simple search engine.
Antivirus solutions primarily depend on known signatures and past behaviors. Malicious apps from SMS phishing, installed outside the Play Store, can evade detection, especially if their code is fresh and harmful actions activate post-installation with granted permissions.
Effective detection relies on connecting several indicators of compromise: a suspicious SMS link from an unknown source, installations from outside the app store, critical permission requests, and visible signs like screen overlays, fake interactions, or screen captures.
Individually, these signals may seem harmless, but together, and in their sequence, they clearly reveal an ongoing attack that an antivirus can easily miss.
How Pradeo Mobile Threat Defense blocks the attack:
Unlike an antivirus, a Mobile Threat Defense (MTD) solution observes the real behavior of the device and acts at every stage of the attack chain:
Phishing link blocking:
Thanks to the anti-phishing module built into the Pradeo Security application, access to the malicious page is directly prevented. The user never reaches the download page and therefore cannot retrieve the APK.
Prevention of risky installations :
Pradeo Mobile Threat Defense detects that an application originates from an unknown source and immediately alerts the security team to prevent potential compromise.
Monitoring of permissions and behaviors :
When an application requests critical permissions (such as Accessibility), Pradeo Mobile Threat Defense flags it as potentially malicious and quarantines it, preventing any device takeover or intrusive actions.
Our solution also monitors UI and system behaviors (overlays, simulated taps, abnormal network activity). At the first sign of a malicious overlay, access to sensitive applications is immediately blocked.
The Herodotus case clearly illustrates that antivirus solutions are not suited to modern mobile threats, which combine social engineering, off-store installations, and abuse of sensitive permissions.
To effectively protect collaborators and corporate data, deploying a Mobile Threat Defense (MTD) solution is now essential.
