{"id":44181,"date":"2021-11-29T16:26:00","date_gmt":"2021-11-29T16:26:00","guid":{"rendered":"http:\/\/2e4f7d42-3358-4da6-a5ce-08137078d4b2"},"modified":"2021-11-29T16:26:00","modified_gmt":"2021-11-29T16:26:00","slug":"over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/","title":{"rendered":"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\/2021\/02\/03\/6841068a-db6e-42d7-8764-a4a5ff08a79d\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" class=\"ff-og-image-inserted\"><\/div>\n<p>Over 300,000 Android smartphone users have downloaded what have turned out to be banking trojans after falling victim to malware which has bypassed detection by the Google Play app store.&nbsp; <\/p>\n<p>Detailed by&nbsp;<a href=\"https:\/\/www.threatfabric.com\/blogs\/deceive-the-heavens-to-cross-the-sea.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">cybersecurity researchers at ThreatFabric<\/a>, the four different forms of&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/what-is-malware-everything-you-need-to-know-about-viruses-trojans-and-malicious-software\/\" target=\"_blank\" rel=\"noopener\">malware<\/a>&nbsp;are delivered to victims via malicious versions of commonly downloaded applications, including document scanners, QR code readers, fitness monitors and cryptocurrency apps. The apps often come with the functions which are advertised in order to avoid users getting suspicious.&nbsp; <\/p>\n<p>In each case, the malicious intent of the app is hidden and the process of delivering the malware only begins once the app has been installed, enabling them to bypass Play Store detections.&nbsp; <\/p>\n<p>The most prolific of the four malware families is Anatsa, which has been installed by over 200,000 Android users \u2013 researchers describe it as an &#8220;advanced&#8221;&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/trojan-malware-the-hidden-cyber-threat-to-your-pc\/\" target=\"_blank\" rel=\"noopener\">banking trojan<\/a>&nbsp;which can steal usernames and passwords, and uses accessibility logging to capture everything shown on the user&#8217;s screen, while a keylogger allows attackers to record all information entered into the phone.&nbsp; <\/p>\n<p><a href=\"https:\/\/www.zdnet.com\/article\/toddler-mobile-banking-malware-surges-across-europe\/\" target=\"_blank\" rel=\"noopener\">Anasta malware<\/a>&nbsp;has been active since January, but appears to have received a substantial push since June \u2013 researchers were able to identify six different malicious applications designed to deliver the malware. These include apps which posed as QR code scanners, PDF scanners and cryptocurrency apps, all of which deliver the malware.&nbsp; <\/p>\n<p>One of these apps is a QR code scanner which has been installed by 50,000 users alone and the download page features a large number of positive reviews, something which can encourage people to download the app. Users are directed to the apps via&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/what-is-phishing-how-to-protect-yourself-from-scam-emails-and-more\/\" target=\"_blank\" rel=\"noopener\">phishing emails<\/a>&nbsp;or&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/this-password-stealing-windows-malware-is-distributed-via-ads-in-search-results\/\" target=\"_blank\" rel=\"noopener\">malicious ad campaigns<\/a>.&nbsp; <\/p>\n<p>After the initial download, users are forced to update the app to continue using it \u2013 it&#8217;s this update which connects to a command and control server and downloads the Anatsa payload onto the device, providing attackers with the means to steal banking details and other information.&nbsp; <\/p>\n<section class=\"sharethrough-top placeholder\"> <\/section>\n<p>The second most prolific of the malware families detailed by researchers at ThreatFabric is Alien,&nbsp;<a href=\"https:\/\/www.threatfabric.com\/blogs\/alien_the_story_of_cerberus_demise.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">an Android banking trojan<\/a>&nbsp;which can also steal two-factor authentication capabilities and which has been active for over a year. The malware has received 95,000 installations via malicious apps in the Play Store.&nbsp; <\/p>\n<p><strong>SEE:&nbsp;<\/strong><a href=\"http:\/\/www.zdnet.com\/topic\/a-winning-strategy-for-cybersecurity\/#link=%7B%22role%22:%22standard%22,%22href%22:%22http:\/\/www.zdnet.com\/topic\/a-winning-strategy-for-cybersecurity\/%22,%22target%22:%22_blank%22,%22absolute%22:%22%22,%22linkText%22:%22%3Cstrong%3EA%20winning%20strategy%20for%20cybersecurity%3C\/strong%3E%22%7D\"><strong>A winning strategy for cybersecurity<\/strong><\/a><strong>&nbsp;(ZDNet special report)<\/strong> <\/p>\n<p>One of these is a gym and fitness training app which when comes with a supporting website designed to enhance the legitimacy, but close inspection of the site reveals placeholder text all over it. The website also serves as the command and control centre for the Alien malware.&nbsp; <\/p>\n<p>Like Anasta, the initial download doesn&#8217;t contain malware, but users are asked to install a fake update \u2013 disguised as a package of new fitness regimes &#8211; which distributes the payload. &nbsp; <\/p>\n<p>The other two forms of malware which have been dropped using similar methods in recent months are Hydra and&nbsp;<a href=\"https:\/\/threatfabric.com\/blogs\/ermac-another-cerberus-reborn.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Ermac,<\/a>&nbsp;which have a combined total of at least 15,000 downloads. ThreatFabric has linked Hydra and Ermac to Brunhilda, a cyber criminal group known to target Android devices with banking malware. Both Hydra and Ermac provide attackers with access to the device required to steal banking information.&nbsp; <\/p>\n<p>ThreatFabric has reported all of the malicious apps to Google and they&#8217;ve either already been removed or are under review. Cyber criminals will continually attempt to find ways to bypass protections to deliver mobile malware, which is becoming increasingly attractive to cyber criminals.&nbsp; <\/p>\n<p>&#8220;The Android banking malware echo-system is evolving rapidly. These numbers that we are observing now are the result of a slow but inevitable shift of focus from criminals towards the mobile landscape. With this in mind, the Google Play Store is the most attractive platform to use to serve malware,&#8221; Dario Durando, mobile malware specialist at ThreatFabric told ZDNet.&nbsp; <\/p>\n<p>The convincing nature of the malicious apps means that they can be hard to identify as a potential threat, but there are steps users can take to avoid infection&nbsp; <\/p>\n<p>&#8220;A good rule of thumb is to always check updates and always be very careful before granting accessibility services privileges &#8211; which will be requested by the malicious payload, after the &#8220;update&#8221; installation &#8211;&nbsp; and be wary of applications that ask to install additional software,&#8221; said Durando. <\/p>\n<p>ZDNet attempted to contact Google for comment but hadn&#8217;t received a response at the time of publication.&nbsp; <\/p>\n<p><strong>MORE ON CYBERSECURITY&nbsp;<\/strong> <\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers at ThreatFabric detail how password-stealing Android banking trojans were disguised as QR code readers, fitness monitors, cryptocurrency apps and more.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-44181","post","type-post","status-publish","format-standard","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-29T16:26:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\/2021\/02\/03\/6841068a-db6e-42d7-8764-a4a5ff08a79d\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers\",\"datePublished\":\"2021-11-29T16:26:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/\"},\"wordCount\":766,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\\\/2021\\\/02\\\/03\\\/6841068a-db6e-42d7-8764-a4a5ff08a79d\\\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/\",\"name\":\"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\\\/2021\\\/02\\\/03\\\/6841068a-db6e-42d7-8764-a4a5ff08a79d\\\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"datePublished\":\"2021-11-29T16:26:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\\\/2021\\\/02\\\/03\\\/6841068a-db6e-42d7-8764-a4a5ff08a79d\\\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\\\/2021\\\/02\\\/03\\\/6841068a-db6e-42d7-8764-a4a5ff08a79d\\\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/","og_locale":"en_US","og_type":"article","og_title":"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-11-29T16:26:00+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\/2021\/02\/03\/6841068a-db6e-42d7-8764-a4a5ff08a79d\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers","datePublished":"2021-11-29T16:26:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/"},"wordCount":766,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\/2021\/02\/03\/6841068a-db6e-42d7-8764-a4a5ff08a79d\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/","url":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/","name":"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\/2021\/02\/03\/6841068a-db6e-42d7-8764-a4a5ff08a79d\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","datePublished":"2021-11-29T16:26:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\/2021\/02\/03\/6841068a-db6e-42d7-8764-a4a5ff08a79d\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/0a6d2e26274191a2a84fe52bef1d8dba33f633f4\/2021\/02\/03\/6841068a-db6e-42d7-8764-a4a5ff08a79d\/istock-1158475162.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/over-300000-android-users-have-downloaded-these-banking-trojan-malware-apps-say-security-researchers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Over 300,000 Android users have downloaded these banking trojan malware apps, say security researchers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=44181"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44181\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=44181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=44181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=44181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}