HOOK Android banking trojan adds ransomware overlay and 107 commands
Malware Activity
Summary
Hide ▲
Show ▼
The HOOK Android banking trojan now adds a full-screen ransomware overlay, increasing extortion risk and expanding its Android fraud capability. The new variant supports 107 remote commands, including overlays for fake NFC, unlock PIN/pattern collection, and credit card harvesting. It is being spread at scale through phishing websites and bogus GitHub repositories that host malicious APK files.
Related Happenings
Trust Wallet hit by network compromise
Incident
H score50
First: 02.01.2026 16:19
Last: 02.01.2026 16:19
Sources 1
About this happening:
Trust Wallet said its Chrome extension was likely compromised through the second iteration of Shai-Hulud in November 2025, exposing GitHub secrets and a Chro...
Trust Wallet hit by network compromise
IncidentAbout this happening: Trust Wallet said its Chrome extension was likely compromised through the second iteration of Shai-Hulud in November 2025, exposing GitHub secrets and a Chro...
Shai-Hulud Chrome extension trojanized backdoor with wallet mnemonic theft
Malware Activity
H score28
First: 31.12.2025 18:29
Last: 31.12.2025 18:29
Sources 1
About this happening:
The Shai-Hulud supply-chain operation delivered a trojanized Google Chrome extension build with a backdoor that could steal wallet mnemonic phrases, creating a direct...
Shai-Hulud Chrome extension trojanized backdoor with wallet mnemonic theft
Malware ActivityAbout this happening: The Shai-Hulud supply-chain operation delivered a trojanized Google Chrome extension build with a backdoor that could steal wallet mnemonic phrases, creating a direct...
DocSwap Android malware variant with encrypted APK loading and RAT capabilities
Malware Activity
H score26
First: 18.12.2025 09:43
Last: 18.12.2025 09:43
Sources 1
About this happening:
A new DocSwap Android malware variant now uses encrypted APK loading to gain RAT capabilities on Android devices. Victims are lured through QR-code phishing and fa...
DocSwap Android malware variant with encrypted APK loading and RAT capabilities
Malware ActivityAbout this happening: A new DocSwap Android malware variant now uses encrypted APK loading to gain RAT capabilities on Android devices. Victims are lured through QR-code phishing and fa...
Albiriox Android malware activity
Malware Activity
H score18
First: 01.12.2025 18:30
Last: 01.12.2025 18:30
Sources 1
About this happening:
Albiriox is an Android malware family now being sold as Malware-as-a-Service, and it matters because it enables remote device takeover and real-time fraud agai...
Albiriox Android malware activity
Malware ActivityAbout this happening: Albiriox is an Android malware family now being sold as Malware-as-a-Service, and it matters because it enables remote device takeover and real-time fraud agai...
Sturnus Android banking trojan with credential theft and device takeover
Malware Activity
H score26
First: 20.11.2025 13:04
Last: 20.11.2025 13:04
Sources 1
About this happening:
A new Android banking trojan called Sturnus has been disclosed with credential theft and full device takeover capabilities, raising fraud risk for mobile banking u...
Sturnus Android banking trojan with credential theft and device takeover
Malware ActivityAbout this happening: A new Android banking trojan called Sturnus has been disclosed with credential theft and full device takeover capabilities, raising fraud risk for mobile banking u...
Timeline
-
26.08.2025 12:01 1 articles · 10mo ago
HOOK Android banking trojan adds ransomware overlays and 107 commands
Initial DisclosureZimperium identified a new HOOK Android banking trojan variant that can deploy a full-screen ransomware overlay to coerce victims into paying, with the overlay triggered by the C2 command "ransome" and removable with "delete_ransome". The sample is assessed as an offshoot of ERMAC, supports 107 remote commands with 38 newly added ones, and is distributed through phishing websites and bogus GitHub repositories hosting malicious APK files.
Show sources
- HOOK Android Trojan Adds Ransomware Overlays, Expands to 107 Remote Commands — thehackernews.com — 26.08.2025 12:01