{
  "name": "TsarBot Trojan Hits 750+ Banking & Crypto Apps!",
  "slug": "tsarbot-trojan-hits-750-banking-crypto-apps",
  "description": "A newly discovered Android banking Trojan, TsarBot, targets over 750 applications globally, including banking, finance, cryptocurrency, and e-commerce apps. It spreads through phishing sites masquerading as legitimate financial platforms and is installed via a dropper disguised as Google Play Services. TsarBot employs overlay attacks to steal credentials, records and remotely controls screens, and uses a fake lock screen to capture device lock credentials. It communicates with its C&C server using WebSocket across multiple ports to receive commands, send stolen data, and execute on-device fraud. The malware's capabilities include screen recording, keylogging, and SMS interception. Evidence suggests the threat actor behind TsarBot is likely of Russian origin.",
  "published": "2025-04-01T12:48:05+00:00",
  "created_at": "2025-04-01T12:48:05+00:00",
  "modified_at": "2025-04-01T15:28:05+00:00",
  "created_at_opencti": "2025-04-01T12:48:05+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-04-01",
    "android",
    "banking trojan",
    "credential-theft",
    "keylogging",
    "on-device fraud",
    "overlay attack",
    "phishing",
    "screen recording",
    "sms interception",
    "tsarbot",
    "websocket"
  ],
  "related_entities": {
    "malware": [
      {
        "id": "c8d1302a-1c6a-4b12-9e90-7e5fa0fca22f",
        "name": "TsarBot",
        "slug": "tsarbot"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "Australia"
      },
      {
        "id": "",
        "name": "United Arab Emirates"
      },
      {
        "id": "",
        "name": "Poland"
      },
      {
        "id": "",
        "name": "France"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://cyble.com/blog/tsarbot-using-overlay-attacks-targeting-bfsi-sector",
    "https://otx.alienvault.com/pulse/67ebfca5b1693b0052687f72"
  ]
}