InfoSecBulletin Cybersecurity for mankind
A new Android banking Trojan called Herodotus has emerged recently. It is offered as Malware-as-a-Service (MaaS) and pretends to be a legitimate app to trick users into installing an APK. After installation, it requests sensitive permissions and can control the device for banking transactions. A modern mobile attack, yet once again, largely invisible to most traditional antivirus solutions.
Herodotus in brief:
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
The banking trojan spreads via SMS phishing links that lead users to a fake page where they are urged to download an app. The victim installs an APK that is not from the Play Store.
Herodotus, once installed and given permissions, asks for critical permissions like Accessibility. It overlays fake screens on real apps to trick users and can capture screens and keystrokes for session takeover while the victim is logged in.
Herodotus avoids detection by anti-fraud systems by adding random delays, subtle movements, and realistic typing patterns to its actions.
Why an antivirus isn’t enough:
The Pradeo team checked for malware in a top antivirus database, but no alerts were triggered for the application. This means the antivirus didn’t detect the malicious app, despite it being easily found through a simple search engine.
Antivirus solutions primarily depend on known signatures and past behaviors. Malicious apps from SMS phishing, installed outside the Play Store, can evade detection, especially if their code is fresh and harmful actions activate post-installation with granted permissions.
Effective detection relies on connecting several indicators of compromise: a suspicious SMS link from an unknown source, installations from outside the app store, critical permission requests, and visible signs like screen overlays, fake interactions, or screen captures.
Individually, these signals may seem harmless, but together, and in their sequence, they clearly reveal an ongoing attack that an antivirus can easily miss.
How Pradeo Mobile Threat Defense blocks the attack:
Unlike an antivirus, a Mobile Threat Defense (MTD) solution observes the real behavior of the device and acts at every stage of the attack chain:
Phishing link blocking:
Thanks to the anti-phishing module built into the Pradeo Security application, access to the malicious page is directly prevented. The user never reaches the download page and therefore cannot retrieve the APK.
Prevention of risky installations :
Pradeo Mobile Threat Defense detects that an application originates from an unknown source and immediately alerts the security team to prevent potential compromise.
Monitoring of permissions and behaviors :
When an application requests critical permissions (such as Accessibility), Pradeo Mobile Threat Defense flags it as potentially malicious and quarantines it, preventing any device takeover or intrusive actions.
Our solution also monitors UI and system behaviors (overlays, simulated taps, abnormal network activity). At the first sign of a malicious overlay, access to sensitive applications is immediately blocked.
The Herodotus case clearly illustrates that antivirus solutions are not suited to modern mobile threats, which combine social engineering, off-store installations, and abuse of sensitive permissions.
To effectively protect collaborators and corporate data, deploying a Mobile Threat Defense (MTD) solution is now essential.
