A highly invasive Android banking trojan dubbed Rokarolla ,named after its primary Command and Control (C2) infrastructure, this newly identified malware systematically drains victim accounts by targeting 217 distinct banking and cryptocurrency applications.
Rokarolla spreads via malicious phishing websites that masquerade as legitimate download portals for popular applications such as TikTok and Google Chrome.
Once installed, it leverages a sophisticated arsenal of 137 administrative commands to execute undetected financial fraud, harvest sensitive data, and maintain absolute control over the infected device.
Rokarolla Steals Android Credentials
The attack sequence begins with a deceptive dropper application that tricks victims into installing a secondary, malicious payload.
To bypass user suspicion and evade Android’s built-in security restrictions, this second-stage malware impersonates the Google Play Protect service.
By masquerading as a critical security feature, the malware manipulates the user into granting excessive permissions, particularly access to Android’s powerful Accessibility Services.
This foundational access allows the Trojan to click through prompts, read on-screen content, and establish deep persistence without requiring further human interaction.
At the core of Rokarolla’s data theft operations is its masterful use of fraudulent screen overlays. The malware routinely queries its C2 server to fetch a target list of financial applications.
When a victim attempts to open one of the targeted banking or crypto apps, Rokarolla dynamically downloads a fake, HTML-based phishing page and injects it directly over the legitimate application interface.
Users unwittingly type their credentials, PINs, or credit card details into this deceptive screen, sending the data straight to attacker-controlled servers.
Rokarolla even deploys fake overlays that mimic the Android lock screen to capture device PINs and swipe patterns, allowing attackers to access the phone even when the user believes it is locked securely.
Instead of relying on traditional continuous screen casting, Rokarolla utilizes a snapshot-based pseudo-VNC mechanism.
It silently captures screenshots of the victim’s device, compresses them into image files, and exfiltrates them with precise timestamps.
Additionally, it abuses the device clipboard by seamlessly swapping copied text in the background.
This tactic is particularly devastating for cryptocurrency users, as the malware can replace a legitimate copied wallet address with the attacker’s address just before a transaction is finalized.
Security analysts can review the complete list of Indicators of Compromise (IOCs) and malicious domains associated with Rokarolla on the Zimperium GitHub repository to fortify defenses against this evolving threat.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| URL (Distribution) | hxxps[://]infocontablidades[.]it[.]com/ | Malicious website used for distributing the dropper payload, masquerading as legitimate apps like TikTok or Google Chrome. |
| Domain (C2) | https://beralisvc.info | Active Command and Control (C2) endpoint used for telemetry and payload retrieval. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
