A new and powerful Android banking trojan, Albiriox, is now available as Malware-as-a-Service (MaaS) offering complete control over the device.
📱 Over 400 financial apps targeted 🏦 💳 💰 📈
Albiriox is preloaded with targets in banking, fintech, crypto wallets, trading apps, and payment platforms.
🎣 Delivery via fake Google Play pages & SMS lures
Researchers observed campaigns targeting Austrian users, redirecting victims to fake PENNY or Google Play Store pages. Victims are tricked into installing a dropper APK, leading to full compromise.
Key capabilities include:
• 👀 Full screen-viewing & manipulation via VNC
• 🔐 Overlay attacks for credential theft
• 🕳 Evasion of FLAG_SECURE using Accessibility Services
• 🖤 Black-screen mode to hide fraudulent activity
• 💾 Exfiltration of banking credentials, messages, and device data
• 📲 Remote device control, gestures, and text injection
• 🔊 Volume manipulation to hide activity
• 🪪 Stealing phone numbers via Telegram bot
• 🔁 Starts automatically on reboot to maintain persistence
🎯 Targets Southern & Central Europe
Cleafy researchers warn that Albiriox is fully functional, despite still being in early-phase testing.
⚠️ Albiriox joins a growing wave of Android MaaS threats, including RadzaRat and campaigns distributing BTMOB and UASecurity Miner through fake websites and adult-content lures.
🔒 Stay safe:
• Never install apps from SMS links
• Avoid “Google Play look-alike” download pages
• Disable “Install unknown apps” on your device
• Monitor permissions regularly
• Use strong mobile security tools
🔎 Full technical breakdowns from Cleafy, Certo, Cyble & Unit42 highlight one trend:
Android fraud malware has fully entered an industrialized phase — easy to buy, easy to deploy, extremely dangerous.
