BeatBanker Android malware activity
Malware Activity
Summary
Hide ▲
Show ▼
The BeatBanker Android malware is actively hijacking devices by posing as a Starlink app, creating risk of credential theft, illicit mining, and remote device control. It combines banking trojan behavior with Monero mining and can also deploy BTMOB RAT for full access. Observed infections were concentrated in Brazil, and the newest variant can replace the banking module with a remote-access payload.
Related Happenings
RedHook Android malware abuses Wireless ADB for shell access
Malware Activity
H score26
First: 12.07.2026 17:27
Last: 12.07.2026 17:27
Sources 1
About this happening:
The RedHook Android malware now abuses Wireless ADB to obtain shell (UID 2000) privileges, expanding its control over infected devices. The change lets the malware ope...
RedHook Android malware abuses Wireless ADB for shell access
Malware ActivityAbout this happening: The RedHook Android malware now abuses Wireless ADB to obtain shell (UID 2000) privileges, expanding its control over infected devices. The change lets the malware ope...
RedWing Android spyware rented through Telegram
Malware Activity
H score21
First: 08.07.2026 18:30
Last: 08.07.2026 18:30
Sources 1
About this happening:
The RedWing Android spyware operation is being rented through Telegram, lowering the barrier for criminals to hijack phones and steal banking credentials. The malware...
RedWing Android spyware rented through Telegram
Malware ActivityAbout this happening: The RedWing Android spyware operation is being rented through Telegram, lowering the barrier for criminals to hijack phones and steal banking credentials. The malware...
RedWing Android bank-fraud malware rental service
Malware Activity
H score21
First: 07.07.2026 20:10
Last: 07.07.2026 20:10
Sources 1
About this happening:
The RedWing Android malware service is being rented on Telegram to steal banking logins, OTPs, and device control, raising fraud risk for banking and cryptocurre...
RedWing Android bank-fraud malware rental service
Malware ActivityAbout this happening: The RedWing Android malware service is being rented on Telegram to steal banking logins, OTPs, and device control, raising fraud risk for banking and cryptocurre...
Rokarolla Android banking trojan activity
Malware Activity
H score26
First: 16.06.2026 16:15
Last: 16.06.2026 16:15
Sources 1
About this happening:
The Rokarolla Android banking trojan is expanding phone-level control on infected devices, letting attackers steal credentials, intercept authentication codes, and hide fr...
Rokarolla Android banking trojan activity
Malware ActivityAbout this happening: The Rokarolla Android banking trojan is expanding phone-level control on infected devices, letting attackers steal credentials, intercept authentication codes, and hide fr...
NFCShare Android malware spreads via fake banking-app updates
Malware Activity
H score21
First: 09.06.2026 01:11
Last: 09.06.2026 01:11
Sources 1
About this happening:
The NFCShare Android malware is being spread as fake banking-app updates on GitHub, broadening attacks against customers of multiple banks and financial institutions acr...
NFCShare Android malware spreads via fake banking-app updates
Malware ActivityAbout this happening: The NFCShare Android malware is being spread as fake banking-app updates on GitHub, broadening attacks against customers of multiple banks and financial institutions acr...
Timeline
-
10.03.2026 23:27 2 articles · 4mo ago
BeatBanker Android malware disclosure and campaign details
Initial DisclosureKaspersky disclosed BeatBanker as a new Android malware campaign targeting users in Brazil that poses as a Starlink app on fake Google Play Store websites to hijack devices, steal credentials, tamper with cryptocurrency transactions, and mine Monero. The newest variant replaces the banking module with BTMOB RAT, while the malware also uses APK delivery, hidden DEX loading, delayed malicious operations, and continuous playback of output8.mp3 to keep a foreground service active.
Show sources
- New BeatBanker Android malware poses as Starlink app to hijack devices — www.bleepingcomputer.com — 10.03.2026 23:27
- Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets — thehackernews.com — 12.03.2026 09:56