Rocinante Trojan Poses as Banking Apps to Steal Sensitive Data from Brazilian Android Users
Briefly

"This malware family is capable of performing keylogging using the Accessibility Service, and is also able to steal PII from its victims using phishing screens posing as different banks."
"Finally, it can use all this exfiltrated information to perform device takeover (DTO) of the device, by leveraging the accessibility service privileges to achieve full remote access on the infected device."
Read at The Hacker News
[
]
[
|
]