InfoSecBulletin Cybersecurity for mankind
A new Android banking trojan called Rokarolla is hitting 217 banking and cryptocurrency apps with a wide range of 137 commands. The harmful software spreads through bad websites pretending to offer the Google Chrome or TikTok app and can gain full control over a hacked device.
Its abilities include stealing lock screen passwords, contact lists, and text messages, and using keyloggers to record what users type. During installation, the app pretends to be Google Play Protect, which helps keep Android safe from malware. It tries to trick users into installing Chrome or TikTok, which have the Rokarolla malware.
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
Australian Energy Giant Origin confirms unauthorized access and disclosure of customer data
Anthropic Unveils Claude Security Plugin for Code Flaw Scanning
When you start Rokarolla on your device, it asks for permissions to use Accessibility services, and to access notifications, SMS, and calls, researchers from the mobile security company Zimperium say in a report today.
Communication with the command-and-control (C2) server starts by sending a simple device profile. This profile has information like the phone model, Android version, language, screen details, battery level, storage space, and available RAM.
Zimperium says this information creates a unique ID for each victim in the Rokarolla campaign.
Zimperium says the malware mainly aims to steal money information. To do this, it looks at the infected device and checks it against a list of 217 apps it wants to target. Then it downloads the phishing files for any apps that match.
When the victim opens an app, Rokarolla shows a fake login screen to take login details, credit card info, and other financial data.
The use of overlays isn’t just for stealing data. The malware also uses this trick to get the lock-screen PIN or pattern and control the device even if it is locked.
Overlays also hide malware actions and stop users from interacting by showing fake installation screens when necessary.
Some other tricks include turning off Google Play Protect, hiding the app icon from the app drawer, making audio and vibrations silent, and keeping the screen on all the time.
Zimperium made a GitHub page that has all 137 commands for Rokarolla. Some of the commands for stealing data are:
Steal SMS messages
Extract contact information and WhatsApp contacts
Capture keystrokes
Record on-screen content via UI logging
Copy and manipulate the clipboard contents
Block incoming calls and bank fraud alerts
Periodically take screenshots and upload them with timestamps
The mix of these features gives Rokarolla users almost total control over a hacked Android device, allowing them to pull off serious financial scams.
Zimperium did not find any malware on Google Play, which is the official place for Android apps. Users should not download APK files from anywhere else unless they really trust the publisher.
Users need to be careful when giving Accessibility permissions. This is because these permissions can be misused to get around normal Android security and let bad apps control the user interface or approve system messages, which is often what Android malware wants.
