{"id":42056,"date":"2021-07-30T14:10:01","date_gmt":"2021-07-30T14:10:01","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32519\/Vultur-Bank-Malware-Infests-Thousands-Of-Devices.html"},"modified":"2021-07-30T14:10:01","modified_gmt":"2021-07-30T14:10:01","slug":"vultur-bank-malware-infests-thousands-of-devices","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/","title":{"rendered":"Vultur Bank Malware Infests Thousands Of Devices"},"content":{"rendered":"<figure class=\"intro-image intro-left\"><img decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/smartphone-bot-800x534.jpeg\" alt=\"New bank-fraud malware called Vultur infects thousands of devices\"><figcaption class=\"caption\"><\/figcaption><\/figure>\n<aside id=\"social-left\" class=\"social-left\" aria-label=\"Read the comments or share this article\"><a title=\"32 posters participating, including story author\" class=\"comment-count icon-comment-bubble-down\" href=\"https:\/\/arstechnica.com\/gadgets\/2021\/07\/new-bank-fraud-malware-called-vultur-infects-thousands-of-devices\/?comments=1\"> <\/p>\n<h4 class=\"comment-count-before\">reader comments<\/h4>\n<p> <span class=\"comment-count-number\">40<\/span> <span class=\"visually-hidden\"> with 32 posters participating, including story author<\/span> <\/a> <\/p>\n<div class=\"share-links\">\n<h4>Share this story<\/h4>\n<\/p><\/div>\n<\/aside>\n<p><!-- cache hit 820:single\/related:f0c8545e96ef0c22f8236ea49e3203f6 --><!-- empty --><\/p>\n<p>Recently detected Android malware, some spread through the Google Play Store, uses a novel way to supercharge the harvesting of login credentials from more than 100 banking and cryptocurrency applications.<\/p>\n<p>The malware, which researchers from Amsterdam-based security firm ThreatFabric are calling Vultur, is among the&nbsp;first Android threats to record a device screen whenever one of the targeted apps is opened. Vultur uses a real implementation of the VNC screen-sharing application to mirror the screen of the infected device to an attacker-controlled server, researchers with ThreatFabric said.<\/p>\n<figure class=\"image shortcode-img center large\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur.jpeg\" class=\"enlarge\" data-height=\"1080\" data-width=\"1920\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-640x360.jpeg\" width=\"640\" height=\"360\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-1280x720.jpeg 2x\"><\/a><figcaption class=\"caption\">\n<div class=\"caption-credit\">ThreatFabric<\/div>\n<\/figcaption><\/figure>\n<figure class=\"image shortcode-img center large\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-banking-trojan.jpeg\" class=\"enlarge\" data-height=\"1080\" data-width=\"1920\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-banking-trojan-640x360.jpeg\" width=\"640\" height=\"360\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-banking-trojan-1280x720.jpeg 2x\"><\/a><figcaption class=\"caption\">\n<div class=\"caption-credit\">ThreatFabric<\/div>\n<\/figcaption><\/figure>\n<h2>The next level<\/h2>\n<p>The typical <em>modus operandi<\/em> for Android-based bank-fraud malware is to superimpose a window on top of the login screen presented by a targeted app. The \u201coverlay,\u201d as such windows are usually called, appears identical to the user interface of the banking app, giving victims the impression they\u2019re entering their credentials into a trusted piece of software. Attackers then harvest the credentials, enter them into the app running on a different device, and withdraw money.<\/p>\n<p>\u201cBanking threats on the mobile platform are no longer only based on well-known overlay attacks, but are evolving into RAT-like malware, inheriting useful tricks like detecting foreground applications to start screen recording,\u201d ThreatFabric researchers wrote of the new Vultur approach in a <a href=\"https:\/\/threatfabric.com\/blogs\/vultur-v-for-vnc.html\">post<\/a>.<\/p>\n<aside class=\"ad_wrapper\" aria-label=\"In Content advertisement\"> <span class=\"ad_notice\">Advertisement <\/span> <\/aside>\n<p>They continued:<\/p>\n<blockquote>\n<p>This brings the threat to another level, as such features open the door for on-device fraud, circumventing detection based on phishing MO\u2019s that require fraud to be performed from a new device: With Vultur fraud can happen on the infected device of the victim. These attacks are scalable and automated since the actions to perform fraud can be scripted on the malware backend and sent in the form of sequenced commands.<\/p>\n<\/blockquote>\n<p>Vultur, like many Android banking trojans, relies heavily on <a href=\"https:\/\/www.android.com\/accessibility\/\">accessibility services<\/a> built into the mobile OS. When first installed, Vultur abuses these services to obtain the permissions required to work. To do this, the malware uses an overlay taken from other malware families. From then on, Vultur monitors all requests that trigger the accessibility services.<\/p>\n<figure class=\"image shortcode-img center large\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/accessibility-services-request.jpeg\" class=\"enlarge\" data-height=\"900\" data-width=\"1600\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/accessibility-services-request-640x360.jpeg\" width=\"640\" height=\"360\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/accessibility-services-request-1280x720.jpeg 2x\"><\/a><figcaption class=\"caption\">\n<div class=\"caption-credit\">ThreatFabric<\/div>\n<\/figcaption><\/figure>\n<h2>Stealth and more<\/h2>\n<p>The malware uses the services to detect requests that come from a targeted app. The malware also uses the services to prevent deletion of the app via traditional measures. Specifically, whenever the user tries to access the app details screen in the Android settings, Vultur automatically clicks the back button. That blocks the user from accessing the uninstall button. Vultur also hides its icon.<\/p>\n<p>Another way the malware remains stealthy: trojanized apps that install it are full-featured programs that actually provide real services, such as fitness tracking or two-factor authentication. Despite the cloaking attempts, however, the malware provides at least one telltale sign that it\u2019s running\u2014whatever trojanized app installed Vultur will appear in the Android notification panel as projecting the screen.<\/p>\n<figure class=\"image shortcode-img right medium\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-screen-projection.jpeg\" class=\"enlarge\" data-height=\"900\" data-width=\"1600\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-screen-projection-300x169.jpeg\" width=\"300\" height=\"169\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-screen-projection-640x360.jpeg 2x\"><\/a><figcaption class=\"caption\">\n<div class=\"caption-credit\">ThreatFabric<\/div>\n<\/figcaption><\/figure>\n<p>Once installed, Vultur starts the screen recording, using VNC implementation from Alpha VNC. To provide remote access to the VNC server running on the infected device, the malware uses <a href=\"https:\/\/danielmiessler.com\/study\/ngrok\/\">ngrok<\/a>, an app that uses an encrypted tunnel to expose local systems hidden behind firewalls to the public Internet.<\/p>\n<aside class=\"ad_wrapper\" aria-label=\"In Content advertisement\"> <span class=\"ad_notice\">Advertisement <\/span> <\/aside>\n<p>The malware is installed by a trojanized app known as a dropper. So far, ThreatFabric researchers have found two trojanized apps in Google Play that install Vultur. They had combined installations of about 5,000, leading the researchers to estimate that the number of Vultur infections is numbered in the thousands. Unlike most Android malware, which relies on third-party droppers, Vultur uses a custom dropper that has come to be called Brunhilda.<\/p>\n<p>\u201cThis dropper and Vultur are both developed by the same threat actor group,\u201d ThreatFabric researchers wrote. \u201cThe choice of developing its own private trojan, instead of renting third-party malware, displays a strong motivation from this group, paired with the overall high level of structure and organization present in the bot as well as the server code.\u201d<\/p>\n<p>The researchers found that Brunhilda was used in the past to install different Android banking malware known as Alien. In all, the researchers estimate Brunhilda has infected more than 30,000 devices. The researchers based the estimate on malicious apps previously available in the Play Store\u2014some with more than 10,000 installations each\u2014as well as figures from third-party markets.<\/p>\n<p>Vultur is programmed to record screens when any of 103 Android banking or cryptocurrency apps are running in the foreground. Italy, Australia, and Spain were the countries with the most banking institutions targeted.<\/p>\n<figure class=\"image shortcode-img right medium\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-targets.png\" class=\"enlarge\" data-height=\"605\" data-width=\"1384\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-targets-300x131.png\" width=\"300\" height=\"131\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2021\/07\/vultur-targets-640x280.png 2x\"><\/a><figcaption class=\"caption\">\n<div class=\"caption-credit\">ThreatFabric<\/div>\n<\/figcaption><\/figure>\n<p>Besides banking and cryptocurrency apps, the malware also harvests credentials for Facebook, Facebook-owned WhatsApp messenger, TikTok, and Viber Messenger. Credential harvesting for these apps occurs through traditional keylogging, although the ThreatFabric post didn\u2019t explain why.<\/p>\n<p>While Google has removed all Play Market apps known to contain Brunhilda, the company\u2019s track record suggests that new trojanized apps will probably appear. Android users should only install apps that provide useful services and, even then, only apps from well-known publishers, when at all possible. People should also pay close attention to user ratings and app behavior for indications of malice.<\/p>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/32519\/Vultur-Bank-Malware-Infests-Thousands-Of-Devices.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":42057,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[60],"tags":[9517],"class_list":["post-42056","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-packet-storm","tag-headlinemalwarebankphonegoogle"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Vultur Bank Malware Infests Thousands Of Devices 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Vultur Bank Malware Infests Thousands Of Devices 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-30T14:10:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/07\/vultur-bank-malware-infests-thousands-of-devices.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"534\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Vultur Bank Malware Infests Thousands Of Devices\",\"datePublished\":\"2021-07-30T14:10:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/\"},\"wordCount\":853,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/vultur-bank-malware-infests-thousands-of-devices.jpg\",\"keywords\":[\"headline,malware,bank,phone,google\"],\"articleSection\":[\"Packet Storm\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/\",\"name\":\"Vultur Bank Malware Infests Thousands Of Devices 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/vultur-bank-malware-infests-thousands-of-devices.jpg\",\"datePublished\":\"2021-07-30T14:10:01+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/vultur-bank-malware-infests-thousands-of-devices.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/vultur-bank-malware-infests-thousands-of-devices.jpg\",\"width\":800,\"height\":534},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/vultur-bank-malware-infests-thousands-of-devices\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,malware,bank,phone,google\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinemalwarebankphonegoogle\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Vultur Bank Malware Infests Thousands Of Devices\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Vultur Bank Malware Infests Thousands Of Devices 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/","og_locale":"en_US","og_type":"article","og_title":"Vultur Bank Malware Infests Thousands Of Devices 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-07-30T14:10:01+00:00","og_image":[{"width":800,"height":534,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/07\/vultur-bank-malware-infests-thousands-of-devices.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Vultur Bank Malware Infests Thousands Of Devices","datePublished":"2021-07-30T14:10:01+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/"},"wordCount":853,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/07\/vultur-bank-malware-infests-thousands-of-devices.jpg","keywords":["headline,malware,bank,phone,google"],"articleSection":["Packet Storm"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/","url":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/","name":"Vultur Bank Malware Infests Thousands Of Devices 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/07\/vultur-bank-malware-infests-thousands-of-devices.jpg","datePublished":"2021-07-30T14:10:01+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/07\/vultur-bank-malware-infests-thousands-of-devices.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/07\/vultur-bank-malware-infests-thousands-of-devices.jpg","width":800,"height":534},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/vultur-bank-malware-infests-thousands-of-devices\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,malware,bank,phone,google","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinemalwarebankphonegoogle\/"},{"@type":"ListItem","position":3,"name":"Vultur Bank Malware Infests Thousands Of Devices"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/42056","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=42056"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/42056\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/42057"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=42056"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=42056"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=42056"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}