New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds
Summary: Researchers at Zimperium's zLabs documented a new Android banking trojan called Rokarolla that targets 217 banking and cryptocurrency apps and carries 137 remote commands. It spreads through malicious sites posing as apps like TikTok and Chrome, installs a dropper disguised as Google Play Protect to gain Accessibility access, then uses HTML overlays to capture banking and wallet logins, a fake lock-screen overlay to capture PINs, and SMS access to intercept one-time codes.
Bottom line: Rokarolla's whole design is aimed at defeating the protections users are told to rely on - it turns Play Protect off, captures the lock-screen PIN, and blocks incoming calls so a bank's fraud warning never reaches the victim. With 137 commands, multiple fallback command-and-control domains, and no patch to apply, pulling a single server does little to stop it.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026