Security researchers have uncovered Sturnus, a highly advanced Android banking trojan currently in early testing — but already more powerful than many established malware families.
Sturnus isn’t just stealing banking logins. It enables full control of an infected device, bypasses encrypted messaging apps, and captures everything the victim sees or types.
🔍 Key Capabilities
📱 Full Device Takeover
- Remote control via VNC
- Live screen streaming + accessibility-based screenshots
- Ability to inject text, tap buttons, scroll, and open apps
- “Black screen” mode hides attacker activity from the user
💳 Designed for Financial Fraud
- Overlays that mimic real banking apps
- Keylogging and UI-tree data capture
- Steals PINs, passwords, and 2FA codes
- Executes fraudulent transactions while the victim sees a blank screen
🔐 Bypasses Encrypted Messaging
- Monitors WhatsApp, Telegram, and Signal after messages are decrypted
- Reads chats, contact lists, and notifications in real time
- Sidesteps end-to-end encryption entirely
🕵️♂️ Advanced Evasion + Persistence
- Device Admin locking to prevent removal
- Anti-analysis protection
- Heavy encryption (RSA + AES) + WebSocket C2
- Environmental monitoring for rooting, USB debugging, SIM changes, etc.
🌍 Target Geography
- Early-stage operations focused on Southern and Central Europe
- Region-specific banking overlays are already prepared
- Indicates testing before a widespread rollout
📌 Why It’s Serious
Sturnus offers attackers:
- Total visibility
- Total control
- Total fraud automation
Even in its developmental phase, it surpasses many long-running Android banking trojans — and its ability to bypass encrypted communications puts high-value individuals and organizations at risk.
👉 Stay vigilant.
👉 Avoid sideloading apps.
👉 Use mobile security protections and monitor permissions carefully.
