InfoSecBulletin Cybersecurity for mankind
A new Android banking Trojan called Herodotus has emerged recently. It is offered as Malware-as-a-Service (MaaS) and pretends to be a legitimate app to trick users into installing an APK. After installation, it requests sensitive permissions and can control the device for banking transactions. A modern mobile attack, yet once again, largely invisible to most traditional antivirus solutions.
Herodotus in brief:
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The banking trojan spreads via SMS phishing links that lead users to a fake page where they are urged to download an app. The victim installs an APK that is not from the Play Store.
Herodotus, once installed and given permissions, asks for critical permissions like Accessibility. It overlays fake screens on real apps to trick users and can capture screens and keystrokes for session takeover while the victim is logged in.
Herodotus avoids detection by anti-fraud systems by adding random delays, subtle movements, and realistic typing patterns to its actions.
Why an antivirus isn’t enough:
The Pradeo team checked for malware in a top antivirus database, but no alerts were triggered for the application. This means the antivirus didn’t detect the malicious app, despite it being easily found through a simple search engine.
Antivirus solutions primarily depend on known signatures and past behaviors. Malicious apps from SMS phishing, installed outside the Play Store, can evade detection, especially if their code is fresh and harmful actions activate post-installation with granted permissions.
Effective detection relies on connecting several indicators of compromise: a suspicious SMS link from an unknown source, installations from outside the app store, critical permission requests, and visible signs like screen overlays, fake interactions, or screen captures.
Individually, these signals may seem harmless, but together, and in their sequence, they clearly reveal an ongoing attack that an antivirus can easily miss.
How Pradeo Mobile Threat Defense blocks the attack:
Unlike an antivirus, a Mobile Threat Defense (MTD) solution observes the real behavior of the device and acts at every stage of the attack chain:
Phishing link blocking:
Thanks to the anti-phishing module built into the Pradeo Security application, access to the malicious page is directly prevented. The user never reaches the download page and therefore cannot retrieve the APK.
Prevention of risky installations :
Pradeo Mobile Threat Defense detects that an application originates from an unknown source and immediately alerts the security team to prevent potential compromise.
Monitoring of permissions and behaviors :
When an application requests critical permissions (such as Accessibility), Pradeo Mobile Threat Defense flags it as potentially malicious and quarantines it, preventing any device takeover or intrusive actions.
Our solution also monitors UI and system behaviors (overlays, simulated taps, abnormal network activity). At the first sign of a malicious overlay, access to sensitive applications is immediately blocked.
The Herodotus case clearly illustrates that antivirus solutions are not suited to modern mobile threats, which combine social engineering, off-store installations, and abuse of sensitive permissions.
To effectively protect collaborators and corporate data, deploying a Mobile Threat Defense (MTD) solution is now essential.
