Datzbro Android banking trojan activity targeting elderly users
Malware Activity
Summary
Hide ▲
Show ▼
Datzbro is a newly identified Android banking trojan that is now tied to device takeover and financial fraud against elderly users, raising the risk of credential theft and account abuse on mobile devices. The malware spreads through social-engineering lures that push victims toward fraudulent app installs, including paths that can bypass Android 13 protections. Its behavior matters because it combines remote control, overlay attacks, and keylogging to let operators act inside a victim’s phone.
Related Happenings
Grandoreiro and BTMOB banking trojan activity targeting Windows and Android
Malware Activity
First: 27.05.2026 19:10
Last: 27.05.2026 19:10
Sources 1
About this happening:
The **Grandoreiro** and **BTMOB** trojans are being used in active campaigns against **Windows** and **Android** targets across **Europe** and **Latin America**, increasing the ri...
Grandoreiro and BTMOB banking trojan activity targeting Windows and Android
Malware ActivityAbout this happening: The **Grandoreiro** and **BTMOB** trojans are being used in active campaigns against **Windows** and **Android** targets across **Europe** and **Latin America**, increasing the ri...
BTMOB Android RAT no-code builder malware activity
Malware Activity
First: 26.05.2026 17:00
Last: 26.05.2026 17:00
Sources 1
About this happening:
The **BTMOB** Android RAT is spreading through **phishing campaigns** across **Brazil and beyond**, raising the risk of **custom payload delivery** and **remote device takeover**....
BTMOB Android RAT no-code builder malware activity
Malware ActivityAbout this happening: The **BTMOB** Android RAT is spreading through **phishing campaigns** across **Brazil and beyond**, raising the risk of **custom payload delivery** and **remote device takeover**....
Premium Deception Android malware campaign
Campaign
First: 20.05.2026 18:30
Last: 20.05.2026 18:30
Sources 1
About this happening:
The **Premium Deception** campaign used **nearly 250 fake Android apps** to enroll victims in premium mobile billing subscriptions, creating direct fraud risk across multiple coun...
Premium Deception Android malware campaign
CampaignAbout this happening: The **Premium Deception** campaign used **nearly 250 fake Android apps** to enroll victims in premium mobile billing subscriptions, creating direct fraud risk across multiple coun...
Trapdoor Android malvertising and ad-fraud campaign
Campaign
First: 19.05.2026 19:38
Last: 19.05.2026 19:38
Sources 1
About this happening:
The **Trapdoor** campaign is a **self-sustaining malvertising and ad-fraud operation** targeting **Android users** and turning app installs into revenue through threat-actor-contr...
Trapdoor Android malvertising and ad-fraud campaign
CampaignAbout this happening: The **Trapdoor** campaign is a **self-sustaining malvertising and ad-fraud operation** targeting **Android users** and turning app installs into revenue through threat-actor-contr...
AI-driven attack surge against customer-facing mobile apps in 2026
Target Trend
First: 19.05.2026 15:00
Last: 19.05.2026 15:00
Sources 1
About this happening:
**Customer-facing mobile apps** faced a sharp rise in attacks in **2026**, with **87%** of monitored apps hit versus **55% in 2022**. The trend matters because **agentic AI** is l...
AI-driven attack surge against customer-facing mobile apps in 2026
Target TrendAbout this happening: **Customer-facing mobile apps** faced a sharp rise in attacks in **2026**, with **87%** of monitored apps hit versus **55% in 2022**. The trend matters because **agentic AI** is l...
Timeline
-
30.09.2025 12:20 2 articles · 7mo ago
ThreatFabric discloses Datzbro Android banking trojan
Initial DisclosureThreatFabric disclosed Datzbro, a previously undocumented Android banking trojan, after discovering in August 2025 a campaign that targeted older adults in Australia, Singapore, Malaysia, Canada, South Africa, and the U.K. through Facebook groups promoting AI-generated "active senior trips" and follow-on APK lures sent over Facebook Messenger or WhatsApp. The malware can conduct device takeover (DTO), remote control, overlay attacks, keylogging, audio recording, photo capture, file access, and theft of Alipay and WeChat PINs and passwords, and some infections use Zombinder to bypass Android 13 and later restrictions.
Show sources
- New Android Trojan “Datzbro” Tricking Elderly with AI-Generated Facebook Travel Events — thehackernews.com — 30.09.2025 12:20
- New Android Trojan “Datzbro” Tricking Elderly with AI-Generated Facebook Travel Events — thehackernews.com — 30.09.2025 12:20