🔒 OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight | 📰 IT Security Nachrichten

Executive Summary

Cyble Research and Intelligence Labs (CRIL) has identified a novel Android banking trojan, dubbed OverlayPhantom, actively distributed in the wild via malicious URLs.

The with the capability and intent to conduct large-scale fraud across Western markets.

Key Takeaways

OverlayPhantom is a sophisticated Android banking trojan distributed via phishing URLs that impersonate high-trust applications.

The malware deploys via a dropper application that simulates a fake Google Play service update and guides victims to enable the Accessibility Service.

It abuses Android's Accessibility Service to silently monitor foreground app activity, intercept user input, simulate gestures, and maintain persistent control over the infected device.

The malware currently targets over 180 banking, finance, and cryptocurrency applications across 10 countries using embedded WebView-based HTML phishing overlays that are visually indistinguishable from the legitimate apps they impersonate.

C&C communication is handled over three dedicated non-standard ports — 9091 for command dispatch, 9092 for device status reporting, and 9090 for screen streaming.

OverlayPhantom supports over 30 remote commands, enabling the threat actor to perform automated gestures, manipulate clipboard content, lock the device screen, display fake notifications, and capture PIN or password input via custom overlay windows.

A built-in JPEG-based screen streaming capability, powered by Android's MediaProjection API, grants the threat actor near real-time visual access to the victim's device screen with minimal bandwidth overhead.

Overview

During an investigation into government-themed URL impersonation, Cyble Research and Intelligence Labs (CRIL) uncovered a previously undocumented Android banking trojan, dubbed OverlayPhantom.

The malware is being actively distributed in the wild through malicious URLs and masquerades as legitimate, high-trust applications to deceive users into installing it. CRIL’s analysis indicates that OverlayPhantom has been active since early May 2025.

The initial sample discovered was hosted at hxxps://bitlrewards-app[.]com/api/download/IDAustria, distributing a malicious APK masquerading as ID Austria — the official Austrian government digital identity application.

The choice of this lure is significant, as impersonating a government identity service creates a strong pages bundled directly into the APK's resources.

These pages are meticulously crafted to impersonate legitimate banking and financial applications, deceiving victims into submitting their credentials or payment card details.

*Figure 5 – Counterfeit HTML phishing pages in the APK file*

When the victim launches a banking or financial application, OverlayPhantom silently checks whether the application's package name is present in its target list.

Upon a positive match, the malware retrieves the corresponding phishing page from its internal resources, renders it in an embedded WebView, and displays it as a seamless overlay window directly above the legitimate application. From the victim's perspective, the experience is indistinguishable from interacting with the genuine application.

*Figure 6 – Fake banking pages designed to steal banking credentials*

Once the victim enters their credentials into the fraudulent overlay, OverlayPhantom harvests the submitted username, password, or card details and silently exfiltrates the stolen data to the C&C server, completing the credential theft cycle without raising any visible indication of compromise on the device.

Screen Streaming

OverlayPhantom provides real-time screen streaming via JPEG, which can be controlled remotely via the startStreamJpeg and stopStreamJpeg commands.

Upon receiving the startStreamJpeg command, the malware initiates a screen capture using Android's MediaProjection API, creating a VirtualDisplay instance named jpeg-stream and attaching it to an ImageReader to continuously capture the device's screen.

The output is resized to a fixed width of 540 pixels, with the height dynamically calculated to preserve the victim device's native screen aspect ratio.

*Figure 7 – Initiating Screen Capturing*

While screen capture is active, the malware establishes a TCP connection to the C&C server on port 9090. Before transmitting any frames, it sends a bot and session identifier, derived from the malware's configured Bot ID and the device ID, to register the streaming session with the operator.

The malware then enters a continuous capture loop, calling acquireLatestImage() to fetch the latest screen frame, converting it into a Bitmap, compressing it as a JPEG, and writing the resulting bytes directly to the socket.

This provides the threat actor with near-real-time visibility into the victim's screen activity while keeping bandwidth consumption lower than that of raw frame transmission.

The streaming loop incorporates resilience logic to handle interruptions gracefully. If no frame is available, the malware briefly sleeps and resumes polling. In the event of a socket failure, it increments a retry counter, pauses for approximately two seconds, closes the active stream and socket, and attempts to re-establish the connection.

Once the retry threshold is exceeded, the streaming flag is disabled to prevent an indefinite number of reconnection attempts. The operator can terminate the stream at any time by issuing the stopStreamJpeg command, which flips the streaming state and invokes the corresponding service logic to cleanly shut down the capture session.

Conclusion

OverlayPhantom represents a mature and methodically engineered Android banking threat. From its deceptive dropper stage — which exploits user trust in the Google Play ecosystem — to its abuse of the Accessibility Service, multi-port C&C architecture, overlay-based credential harvesting, and real-time screen streaming, the malware demonstrates a high degree of operational sophistication.

Its broad targeting scope, encompassing over 180 banking, financial, and cryptocurrency applications across 10 countries at the time of this analysis, further underscores the scale of the threat actor's ambitions. Based on the observed functionality, we anticipate the threat actor’s targeting scope and potential blast radius will continue to expand.

The techniques employed by OverlayPhantom are not novel in isolation, but their combination, particularly the use of government and consumer application lures, hardcoded phishing overlays, and granular remote-control capabilities, reflects a threat actor with both the technical capability and the strategic intent to conduct large-scale financial fraud across multiple regions.

Organizations and individuals operating in the targeted geographies should treat this threat with a high degree of urgency.

Our Recommendations

We have listed some essential . Avoid third-party app stores or links received via SMS, social media, or email.

Be Cautious with Permissions and Installs:
Never grant permissions and install an application unless you're certain of an app's legitimacy.

Watch for Phishing Pages:
Always verify the URL and avoid suspicious links and websites that ask for sensitive information.

Enable Multi-Factor Authentication (MFA):
Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.

Report Suspicious Activity:
If you suspect you've been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.

Use Mobile Security Solutions:
Install a mobile security application that includes real-time scanning.

Keep Your Device Updated:
Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities exploited by malware.

MITRE ATT&CK® Techniques

tsecurity.de LIVE

tsecurity.de Live Threat Radar

OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight

Executive Summary

Key Takeaways

Overview

Conclusion

Our Recommendations

MITRE ATT&CK® Techniques

Community Threat-Level Barometer

Community-Analysen & Experten-Meinungen 0

Verwandte Story-Cluster & Quellen (Vektor-KI)

Auch interessante Nachrichten OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight

Mega-Upate für Google Pixel: Android 17 QPR1 bringt euch 25+ Neuerungen und 20 Fixes

Three checks that were green for the wrong reason

The Realpolitik of Tech: Navigating the Machiavellian Reality of People Management

Treat the Grader as Code, Not a Hidden Prompt

[Event Sourcing] Trying out Sekiban DCB: Implementation

An LLM Is Not Your Backend — Here's What I Learned

🔖 Gespeicherte Artikel

tsecurity.de App

Aktivitäten deiner Analysten

Neues Thema oder Eilmeldung einreichen

Heiß diskutierte Einreichungen

tsecurity.de LIVE

Themen-Radar & Intelligence Matrix

tsecurity.de Live Threat Radar

OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight

Executive Summary

Key Takeaways

Overview

Conclusion

Our Recommendations

MITRE ATT&CK® Techniques

Community Threat-Level Barometer

Community-Analysen & Experten-Meinungen 0

Verwandte Story-Cluster & Quellen (Vektor-KI)

Auch interessante Nachrichten OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight

Mega-Upate für Google Pixel: Android 17 QPR1 bringt euch 25+ Neuerungen und 20 Fixes

Three checks that were green for the wrong reason

The Realpolitik of Tech: Navigating the Machiavellian Reality of People Management

Treat the Grader as Code, Not a Hidden Prompt

[Event Sourcing] Trying out Sekiban DCB: Implementation

An LLM Is Not Your Backend — Here's What I Learned

🔖 Gespeicherte Artikel

tsecurity.de App

Community Radar & Live Chat

Aktivitäten deiner Analysten

Neues Thema oder Eilmeldung einreichen

Heiß diskutierte Einreichungen Aktualisieren

Heiß diskutierte Einreichungen