{"id":26427,"date":"2019-03-28T10:00:00","date_gmt":"2019-03-28T10:00:00","guid":{"rendered":"http:\/\/cd127773-f817-49f4-9e9d-448f80bfbe28"},"modified":"2019-03-28T10:00:00","modified_gmt":"2019-03-28T10:00:00","slug":"gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/","title":{"rendered":"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps"},"content":{"rendered":"<p><a rel=\"nofollow\" href=\"https:\/\/www.zdnet.com\/article\/gustuff-android-banking-trojan-targets-100-banking-im-and-cryptocurrency-apps\/#modal-absolute-74211608-66b5-4401-bea4-1d463e18cd4c\" data-open=\"modal\"><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/2019\/03\/28\/74211608-66b5-4401-bea4-1d463e18cd4c\/da872c86a5263e72d5a3b49bc5b8dc41\/gustuff.png\" class alt=\"Gustuff\"><\/span><\/a><\/p>\n<div class=\"modal infographic\" id=\"modal-absolute-74211608-66b5-4401-bea4-1d463e18cd4c\">\n<div class=\"modal-body\"><span class=\"img\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/zdnet3.cbsistatic.com\/hub\/i\/r\/2019\/03\/28\/74211608-66b5-4401-bea4-1d463e18cd4c\/resize\/1170x878\/3e292c71f1abbbffc77b784a44938f9e\/gustuff.png\" class alt height=\"878\" width=\"1170\"><\/span><\/div>\n<\/div>\n<p>A new Android banking trojan is starting to gain popularity on the cybercriminal underworld. Named Gustuff, the trojan has been around for almost a year, during which time it slowly received updates over updates, becoming a powerhouse in terms of features and targeting capabilities.<\/p>\n<p>This Android banking trojan now joins the ranks of similar top-tier threats, such as Anubis, Red Alert, Exobot, LokiBot, and BankBot.<\/p>\n<p>According to an analysis of Gustuff shared with <em>ZDNet<\/em> by cyber-security firm <a href=\"https:\/\/www.group-ib.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Group-IB<\/a>, Gustuff can phish credentials and automate bank transactions for over 100 banking apps and 32 cryptocurrency apps.<\/p>\n<p>Targets include known banks such as Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank, and PNC Bank, but also cryptocurrency apps such as BitPay, Cryptopay, Coinbase, and Bitcoin Wallet.<\/p>\n<p>In addition, the trojan can also phish credentials for various other Android pyment and messaging apps, such as PayPal, Western Union, eBay, Walmart, Skype, WhatsApp, Gett Taxi, Revolut, and others.<\/p>\n<h3>Gustuff&#8217;s unique trick<\/h3>\n<p>Under its hood, Gustuff operates like all the other Android banking trojans on the market. It uses social engineering to trick users into giving it access to the Android Accessibility service, a feature meant for users with disabilities and a powerful tool that can automate various UI interactions and tap screen items on the user&#8217;s behalf.<\/p>\n<p>Most Android banking malware uses this service to give itself admin rights and show the fake login pages on top of other apps. However, Gustuff abuses this service differently, and in a more complex and devious way than all its competitors.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_ZD_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>&#8220;Trojans that use [the] Accessibility Service is indeed not a rare occurrence,&#8221; Rustam Mirkasymov, Head of Dynamic Analysis of Malware Department at Group-IB told <em>ZDNet<\/em> yesterday. &#8220;Gustuff&#8217;s unique feature is that it is capable of performing ATS with the help of the Accessibility Service.&#8221;<\/p>\n<p>An ATS is a term specific to the banking &#8211;and banking malware&#8211; sector. It stands for Automatic Transfer Service. When used in the context of malware, it refers to a banking trojan&#8217;s ability to make transactions from an infected user&#8217;s computer, rather than stealing their account credentials and then using those credentials to steal money via other computers\/smartphones.<\/p>\n<p>Basically, thanks to the Android Accessibility service, Gustuff has implemented an ATS system right on the user&#8217;s phone. It can open apps, fill in credentials and transaction details, and approve money transfers on its own.<\/p>\n<p>Banking trojans meant to infect Windows computers have been doing this for years, with the help of services like <a href=\"https:\/\/en.wikipedia.org\/wiki\/Virtual_Network_Computing\" target=\"_blank\" rel=\"noopener noreferrer\">VNC<\/a>, but ATSes are still a rare occurrence for Android banking trojans.<\/p>\n<p>&#8220;The fact that Gustuff uses [an] ATS makes it even more advanced than Anubis and RedAlert,&#8221; Mirkasymov told <em>ZDNet<\/em>.<\/p>\n<h3>Not on the Google Play Store yet<\/h3>\n<p>But while the trojan is more advanced than most of its competition, it has not been that popular. Gustuff was never deployed inside apps uploaded on the official Google Play Store, as it currently appears to be unable to bypass Google&#8217;s security scans &#8212;<a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/droppers-is-how-android-malware-keeps-sneaking-into-the-play-store\/\" target=\"_blank\" rel=\"noopener noreferrer\">unlike most of its rivals<\/a>.<\/p>\n<p>Currently, the only way threat actors have been seen distributing the trojan has been through SMS spam that carries links to the trojan&#8217;s APK installation file, Group-IB said.<\/p>\n<p>The trojan has been on the market since April 2018, when its author first started advertising it on a well-known forum for Russian-speaking cybercriminals.<\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/www.zdnet.com\/article\/gustuff-android-banking-trojan-targets-100-banking-im-and-cryptocurrency-apps\/#modal-absolute-e0c3a889-3cdf-4549-b1ce-3f761d2ca601\" data-open=\"modal\"><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/article\/gustuff-android-banking-trojan-targets-100-banking-im-and-cryptocurrency-apps\/\" class=\"lazy\" alt=\"Gustuff ad\" data-original=\" https:\/\/zdnet2.cbsistatic.com\/hub\/i\/2019\/03\/28\/e0c3a889-3cdf-4549-b1ce-3f761d2ca601\/c793cb51cc9e5e4dab1ea01aaed91d32\/gustuff-ad.jpg\"><\/span><noscript><\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/2019\/03\/28\/e0c3a889-3cdf-4549-b1ce-3f761d2ca601\/c793cb51cc9e5e4dab1ea01aaed91d32\/gustuff-ad.jpg\" class alt=\"Gustuff ad\"><\/span><\/p>\n<p><\/noscript><\/a> <span class=\"credit\">Image: ZDNet<\/span><\/p>\n<div class=\"modal infographic\" id=\"modal-absolute-e0c3a889-3cdf-4549-b1ce-3f761d2ca601\">\n<div class=\"modal-body\"><span class=\"img\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/zdnet4.cbsistatic.com\/hub\/i\/r\/2019\/03\/28\/e0c3a889-3cdf-4549-b1ce-3f761d2ca601\/resize\/1170x878\/148109e65d22952691af8f3653f3224d\/gustuff-ad.jpg\" class alt height=\"878\" width=\"1170\"><\/span><\/div>\n<\/div>\n<h3>Other Gustuff features<\/h3>\n<p>Besides having built an Accessibility Service-powered ATS, Gustuff also has other features. According to its ad, Gustuff can also turn off Google Play Protect, a security feature of the Google Play app &#8211;which according to its author, works in 70 percent of cases.<\/p>\n<p>The trojan is also able to show custom push notifications that can pose as any app, but when clicked, open either a web page showing a phishing form to steal login credentials for a specific service, or they open the legitimate app, where the trojan auto-fills transaction forms and uses the Accessibility service to automatically approve funds transfers.<\/p>\n<p>Last, but not least, the trojan can also collect data from infected devices, such as documents, photos, and videos, if necessary. Its most insidious feature is Gustuff&#8217;s ability to reset a device to factory settings, in case trojan operators fear their presence on the device would ever be discovered.<\/p>\n<h3>Related malware and cybercrime coverage:<\/h3>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/gustuff-android-banking-trojan-targets-100-banking-im-and-cryptocurrency-apps\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gustuff also possesses a feature unique among all Android banking trojans.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":26428,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-26427","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-03-28T10:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/03\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"425\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps\",\"datePublished\":\"2019-03-28T10:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/\"},\"wordCount\":734,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/\",\"name\":\"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png\",\"datePublished\":\"2019-03-28T10:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/03\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png\",\"width\":1000,\"height\":425},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/","og_locale":"en_US","og_type":"article","og_title":"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-03-28T10:00:00+00:00","og_image":[{"width":1000,"height":425,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/03\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps","datePublished":"2019-03-28T10:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/"},"wordCount":734,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/03\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/","url":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/","name":"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/03\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png","datePublished":"2019-03-28T10:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/03\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/03\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps.png","width":1000,"height":425},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/gustuff-android-banking-trojan-targets-125-banking-im-and-cryptocurrency-apps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Gustuff Android banking trojan targets 125+ banking, IM, and cryptocurrency apps"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/26427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=26427"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/26427\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/26428"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=26427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=26427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=26427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}