A dangerous new Android banking trojan is operating with a level of sophistication that should alarm security professionals, financial institutions, and mobile users alike. Dubbed Rokarolla — a name derived from its command-and-control infrastructure — this malware quietly targets 217 banking and cryptocurrency applications, executing a layered attack chain that combines credential theft, clipboard hijacking, call blocking, and silent screen surveillance into a single, highly coordinated campaign.

Threat Alert: A dangerous new Android banking trojan is operating with a level of sophistication that should alarm security professionals, financial institutions, and mobile users alike.

A Trojan Built on Deception From the First Tap

Rokarolla's infection chain begins with a familiar tactic executed with unusual cunning. Victims encounter malicious websites dressed up as legitimate app download pages for popular platforms like TikTok and Google Chrome. Once they download and install what they believe is a trusted application, they are actually deploying a dropper — a first-stage payload whose sole purpose is to prepare the ground for the real malware.

What makes this dropper particularly insidious is its disguise: it impersonates Google Play Protect, Android's built-in security scanning service. By wearing the face of the very system designed to flag malicious software, the dropper pre-empts user suspicion. Victims who might otherwise be cautious are reassured by the familiar branding — and promptly grant the app the permissions it needs to proceed.

The most critical of those permissions is Accessibility Services. Once granted, this single access point unlocks virtually the entire attack surface of the device. Rokarolla can simulate screen taps, read and interact with on-screen UI elements, inject fraudulent overlays on top of legitimate applications, and execute automated sequences entirely without victim interaction. Among its reported 137 operational commands, one of the first it executes is disabling Google Play Protect entirely — stripping away the very protection it mimicked to gain entry.

The Overlay Engine: Stealing Credentials at Scale

Rokarolla's target application list is not hardcoded. Instead, it is pulled dynamically from the C2 server, allowing operators to update targets on the fly without redeploying the malware itself. For each flagged application, the trojan downloads a corresponding fake HTML login page and stores it locally in a SQLite database on the compromised device.

When a victim opens a legitimate banking or crypto app, Rokarolla detects the launch and immediately renders its fraudulent page on top of the real interface. The victim sees what appears to be a normal login screen and enters their credentials — which are silently captured and exfiltrated to attacker-controlled infrastructure. Card numbers, account details, and authentication tokens all flow outward without a single visible sign of compromise.

The same overlay technique is applied to Android's lock screen itself. A convincing fake PIN entry interface replaces the legitimate one, capturing device unlock credentials and transmitting them to the attackers. This means the operator can issue commands and interact with the device even when the legitimate owner is not actively using it — a capability that transforms Rokarolla from a passive credential harvester into an active, remote-controlled fraud platform.

Silencing the Victim's Defenses

Perhaps the most operationally mature aspect of Rokarolla is its systematic suppression of every mechanism that might alert a victim during an active fraud session.

Silencing the Victim's Defenses
Call blocking: The malware requests default call handler status, enabling it to silently block incoming calls. A fraud alert call from a bank's security team simply never rings.
Audio and vibration suppression: All device sounds and vibrations are muted during active operations, masking notification chimes that might signal an incoming verification code or security alert.
Screen-on enforcement: The malware forces the device screen to remain active indefinitely, preventing timeouts that could interrupt automated overlay sequences or background processes.
SMS interception: Rokarolla reads all incoming messages and can send messages from the victim's number — sufficient to intercept and forward one-time passwords sent by banks to approve logins and high-value transactions.
By combining call blocking, audio suppression, and SMS interception, Rokarolla effectively cuts the victim off from every real-time alert channel their financial institution might use to flag suspicious activity.

Clipboard Hijacking and Silent Screen Surveillance

For cryptocurrency users, Rokarolla adds a particularly devastating capability: clipboard address swapping. When a victim copies a cryptocurrency wallet address to execute a transaction, the malware silently replaces the clipboard contents with an attacker-controlled address. There is no visual indicator, no confirmation prompt — the victim pastes what they believe is the correct address and completes the transaction, sending funds directly to the attacker.

A parallel keylogger and on-screen content logger capture everything typed and displayed on the device. WhatsApp contact data is scraped by parsing UI nodes and matching known interface terms, enabling social engineering follow-on attacks. Even the device's contact list and communication history become intelligence assets for the operators.

For screen surveillance, Rokarolla deliberately avoids the Android MediaProjection API — the standard screen-casting method — because it triggers a visible recording notification that would immediately reveal the malware's presence. Instead, the trojan employs a snapshot-based approach, systematically capturing compressed PNG screenshots and exfiltrating them silently, achieving continuous visual surveillance without triggering any system-level warning.

What You Should Do

For Individual Users

  • Only install applications from the Google Play Store. Rokarolla spreads exclusively through third-party websites — sideloading remains the primary infection vector.
  • Treat Accessibility Services requests with extreme suspicion. Legitimate apps almost never require this permission. Any app requesting it outside of verified assistive technology tools should be considered high-risk.
  • Verify clipboard contents before confirming cryptocurrency transactions. Always manually inspect wallet addresses after pasting, especially for high-value transfers.
  • Monitor for unusual device behavior: Screen staying on unexpectedly, muted audio without apparent cause, or unknown apps in the app list are potential indicators of compromise.

For Security Teams and Financial Institutions

  • Implement mobile threat defense (MTD) solutions capable of detecting overlay attacks and Accessibility Service abuse at the device level.
  • Evaluate SMS-based OTP reliance in authentication workflows — Rokarolla demonstrates that SMS interception remains a viable and actively exploited attack surface.
  • Educate customers on social engineering distribution tactics, particularly fake app download sites impersonating trusted brands and Google services.
  • Establish behavioral anomaly detection for transaction patterns that may indicate automated, attacker-controlled device activity rather than legitimate user behavior.

Rokarolla represents a meaningful evolution in mobile banking malware — not through any single novel technique, but through the disciplined integration of many proven methods into a seamless, self-concealing attack framework. The decision to impersonate Play Protect, the avoidance of detectable screen-cast APIs, the dynamic target list managed server-side: each choice reflects deliberate operational security awareness from its developers. Security teams and individual users alike should treat this campaign as a benchmark for the current capabilities of financially motivated mobile threat actors.