Android Banking Trojan Vultur Resurfaces With Advanced Features

Vultur, an Android banking trojan previously disclosed in 2021, has reemerged with sophisticated features, facilitating remote interaction with infected devices and data theft. Disguising itself as legitimate apps, it leverages encrypted payloads and telephone-oriented attack delivery techniques. Distributed via trojanized apps on Google Play Store, it poses significant risks to unsuspecting users. The trojan, part of a dropper-as-a-service operation called Brunhilda, orchestrates attacks by inducing urgency through SMS messages and phone calls. Upon installation, it executes payloads to establish bot connections with the command-and-control server, gaining accessibility permissions. Recent developments showcase its focus on maximizing remote control capabilities over compromised devices, posing grave threats to user privacy and security. Concurrently, the Octo Android banking trojan transitions to malware-as-a-service, offering advanced features for information theft, with campaigns targeting thousands of devices globally, underscoring the escalating threat landscape.