Gustuff banking botnet targets Australia
Summary: Cisco Talos uncovered an Android banking trojan campaign targeting Australian financial institutions, tied to the earlier "ChristinaMorrow" SMS spam scam, and assessed with high confidence that it is the Gustuff malware advertised on the Exploit.in forum as a botnet for rent by a seller named "bestoffer." The malware spreads via SMS commands (sendSMSMass) to four or five contacts at a time, harvests credentials through webview overlays on Australian banking apps, and can regain control via direct SMS if its command and control server is taken down.
What's compelling: Talos notes that SMS-based two-factor authentication fails against this trojan because the attacker can read the victim's text messages, and the malware's SMS fallback channel means taking down its C2 server does not end the infection.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026