Security researchers at Zimperium's zLabs have documented a new Android banking trojan, Rokarolla, that targets 217 banking and cryptocurrency applications. The malware packs 137 remote commands, granting operators extensive control over infected devices.
Rokarolla's capabilities include lifting lock-screen PINs, reading and sending SMS messages, rewriting clipboard contents to redirect cryptocurrency payments, and disabling Google Play Protect. This combination of features elevates it beyond typical banking trojans into a full remote-access tool.
The malware spreads primarily through fake TikTok and Chrome downloads, according to Dark Reading. This distribution method exploits users' trust in popular apps to achieve initial compromise.
Zimperium's analysis indicates that Rokarolla represents an evolution in mobile malware, merging traditional banking fraud with comprehensive device surveillance and remote control. The trojan's extensive command set allows operators to execute a wide range of malicious actions without user interaction.
No official patches or mitigation guidelines have been released by Google at this time. Users are advised to avoid sideloading apps, disable installation from unknown sources, and rely on official app stores until a permanent fix is available.