Malware
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
In recent weeks, Group‑IB identified a banking Trojan dubbed “Godfather” that has infected users of over 400 mobile financial applications across 16 countries. The malware operates on both Android and iOS platforms, exploiting app permissions to harvest credentials and inject fraudulent transactions.
Impact
The Trojan has caused unauthorized transfers from victim accounts, with financial losses reported in the low‑hundreds of thousands of USD. Users of targeted apps in the United States, Brazil, India, and several European nations have been affected.
What to Do
Defenders should take the following actions immediately:
- Verify that all mobile banking apps are updated to the latest version; remove any that are no longer supported.
- Enable two‑factor authentication on all financial accounts and enforce app‑level biometric verification.
- Deploy mobile device management (MDM) solutions that can detect and quarantine malicious code signatures associated with the Godfather family.
- Educate users to avoid downloading banking apps from unofficial stores and to scrutinize app permissions.
- Monitor transaction logs for irregular outbound transfers and set up alerts for large or cross‑border movements.
Severity: High – the Trojan can bypass standard authentication and execute transactions without user consent.
Related articles
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
Read briefing
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing
RTM Group Banking Trojan Infection: Forensic Findings and Defender Actions
A forensic investigation of a workstation infected with a banking trojan distributed by the RTM group revealed credential theft, persistence, and lateral movement. Defenders should isolate affected hosts, review authentication logs, and deploy EDR signatures to mitigate future attacks.
Read briefing