Cybersecurity articles tagged #Android Malware on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/banking-trojans-manic-grandoreiro-toxicpanda-2-0-activehttps://runtimerebel.com/blog/banking-trojans-manic-grandoreiro-toxicpanda-2-0-activeNew and updated banking trojans Manic, Grandoreiro, and ToxicPanda 2.0 are actively targeting financial users globally, stealing credentials and data.Sat, 22 Aug 2026 16:14:50 GMTBanking TrojanGrandoreiroAndroid MalwareManicToxicPandahttps://runtimerebel.com/blog/android-car-head-units-infected-by-moyu-proxy-botnet-malwarehttps://runtimerebel.com/blog/android-car-head-units-infected-by-moyu-proxy-botnet-malwareA supply-chain attack by MoYu Group uses a legitimate update app to infect Android car head units, forming a proxy botnet for ad fraud.Sat, 22 Aug 2026 16:13:49 GMTAndroid MalwareProxy BotnetSupply Chain AttackAd FraudMoYu Grouphttps://runtimerebel.com/blog/android-malware-windrelay-spynote-nfc-relay-for-loan-fraudhttps://runtimerebel.com/blog/android-malware-windrelay-spynote-nfc-relay-for-loan-fraudA sophisticated Android malware combination, WindRelay and SpyNote, facilitates real-time NFC credit card fraud and unauthorized loans.Thu, 13 Aug 2026 09:03:15 GMTAndroid MalwareSocial EngineeringFinancial FraudWindRelaySpyNotehttps://runtimerebel.com/blog/flying-eagle-mobile-rat-builder-china-s-infostealer-as-a-servicehttps://runtimerebel.com/blog/flying-eagle-mobile-rat-builder-china-s-infostealer-as-a-serviceAnalysis of the 'Flying Eagle' mobile RAT builder, a sophisticated malware-as-a-service platform from China, used by threat groups to deploy infostealers targeting…Thu, 30 Jul 2026 02:32:07 GMTFlying EagleMobile RATAndroid MalwareInfostealerMalware as a ServiceFinancial FraudChinahttps://runtimerebel.com/blog/netnut-residential-proxy-disrupted-2m-android-devices-cut-offhttps://runtimerebel.com/blog/netnut-residential-proxy-disrupted-2m-android-devices-cut-offA joint operation disrupted NetNut, a residential proxy network leveraging over 2 million compromised Android devices, including smart TVs and streaming boxes.Sat, 04 Jul 2026 06:48:52 GMTNetNutResidential ProxyAndroid MalwareBotnetProxy DisruptionSmart TV Securityhttps://runtimerebel.com/blog/iranian-nexus-tag-182-deploys-markirat-android-surveillancehttps://runtimerebel.com/blog/iranian-nexus-tag-182-deploys-markirat-android-surveillanceRuntime Rebel analyzes Iranian-nexus TAG-182's use of MarkiRAT malware. Disguised as fake VPN/media apps, it conducts cyber surveillance against domestic targets.Thu, 02 Jul 2026 07:41:52 GMTTAG 182MarkiRATIranCyber SurveillanceAndroid MalwareMobile ThreatAPThttps://runtimerebel.com/blog/popa-botnet-linked-to-alarum-technologies-netnut-proxy-servicehttps://runtimerebel.com/blog/popa-botnet-linked-to-alarum-technologies-netnut-proxy-serviceResearchers link the massive Popa Android botnet to NetNut, a residential proxy provider. The botnet exploits millions of TV boxes for fraud and scraping.Fri, 19 Jun 2026 09:47:40 GMTPopa BotnetNetNutAlarum TechnologiesAndroid MalwareResidential ProxyAd Fraudhttps://runtimerebel.com/blog/rokarolla-android-malware-targets-217-financial-appshttps://runtimerebel.com/blog/rokarolla-android-malware-targets-217-financial-appsNew Rokarolla Android banking trojan targets 217 financial and crypto applications. Learn its TTPs and how to protect mobile banking apps from malware.Tue, 16 Jun 2026 21:08:26 GMTRokarollaAndroid MalwareBanking TrojanMobile SecurityFinancial ServicesOverlay Attackhttps://runtimerebel.com/blog/nfcshare-malware-github-spoofing-leads-to-nfc-relay-attackshttps://runtimerebel.com/blog/nfcshare-malware-github-spoofing-leads-to-nfc-relay-attacksAttackers leverage GitHub to distribute NFCShare (NGate) malware, utilizing NFC relay attacks to clone payment cards and perform unauthorized ATM withdrawals.Tue, 09 Jun 2026 00:56:06 GMTAndroid MalwareNfcshareNgateGithub ThreatsMobile Bankinghttps://runtimerebel.com/blog/asin-android-spyware-targets-arabic-users-via-fake-war-mapshttps://runtimerebel.com/blog/asin-android-spyware-targets-arabic-users-via-fake-war-mapsESET identifies Asin, a new Android spyware targeting Arabic speakers through malicious websites masquerading as news platforms and utility applications.Fri, 05 Jun 2026 16:54:06 GMTAsin SpywareAndroid MalwareMiddle East ThreatsESEThttps://runtimerebel.com/blog/btmob-android-malware-analyzing-phishing-driven-full-device-takeoverhttps://runtimerebel.com/blog/btmob-android-malware-analyzing-phishing-driven-full-device-takeoverBTMOB malware targets Android users via phishing, utilizing VNC and accessibility services to facilitate financial theft and total remote device control.Thu, 28 May 2026 13:26:29 GMTBTMOBAndroid MalwarePhishingVNCFinancial FraudMobile Securityhttps://runtimerebel.com/blog/grandoreiro-and-btmob-rat-campaigns-target-windows-and-android-usershttps://runtimerebel.com/blog/grandoreiro-and-btmob-rat-campaigns-target-windows-and-android-usersAnalysis of Grandoreiro and BTMOB malware campaigns targeting financial sectors in Spain, Portugal, and Latin America through Windows and Android platforms.Wed, 27 May 2026 17:11:44 GMTGrandoreiroBTMOBBanking TrojanAndroid MalwareESETWatchGuardhttps://runtimerebel.com/blog/trickmo-android-trojan-uses-ton-blockchain-for-covert-c2https://runtimerebel.com/blog/trickmo-android-trojan-uses-ton-blockchain-for-covert-c2TrickMo Android banking malware adopts The Open Network (TON) blockchain for decentralized C2, targeting European users via accessibility service abuse.Mon, 11 May 2026 09:18:04 GMTTrickmoAndroid MalwareTON BlockchainBanking TrojanFintech Threatshttps://runtimerebel.com/blog/telegram-mini-apps-exploited-for-crypto-scams-and-malware-deliveryhttps://runtimerebel.com/blog/telegram-mini-apps-exploited-for-crypto-scams-and-malware-deliveryThreat actors are weaponizing Telegram Mini Apps to distribute Android malware and deploy sophisticated crypto drainers via TON blockchain exploits.Sun, 03 May 2026 16:20:23 GMTTelegramMini AppsAndroid MalwareCrypto ScamsTON BlockchainPhishinghttps://runtimerebel.com/blog/ngate-android-malware-trojanized-handypay-targets-nfc-data-in-brazilhttps://runtimerebel.com/blog/ngate-android-malware-trojanized-handypay-targets-nfc-data-in-brazilAttackers are deploying NGate malware in Brazil by trojanizing the HandyPay app to capture NFC data and PINs using AI-generated malicious code.Tue, 21 Apr 2026 12:30:50 GMTNgateAndroid MalwareNFC TheftHandyPayBrazil Threatshttps://runtimerebel.com/blog/mirax-rat-analysis-android-devices-targeted-for-proxy-node-abusehttps://runtimerebel.com/blog/mirax-rat-analysis-android-devices-targeted-for-proxy-node-abuseMirax RAT targets Android users in Europe via MaaS, converting infected devices into residential proxy nodes. Technical analysis of capabilities and TTPs.Wed, 15 Apr 2026 12:30:33 GMTMirax RATAndroid MalwareProxy BotnetMobile Securityhttps://runtimerebel.com/blog/perseus-android-banking-malware-targets-notes-apps-for-data-thefthttps://runtimerebel.com/blog/perseus-android-banking-malware-targets-notes-apps-for-data-theftResearchers discover Perseus, a new Android banking malware evolved from Cerberus, targeting notes apps to facilitate device takeover and financial fraud.Thu, 19 Mar 2026 16:24:30 GMTPerseus MalwareAndroid MalwareBanking TrojanCerberusFinancial Fraud