Rokarolla is a newly identified Android banking trojan that demonstrates how mobile malware is evolving from simple credential theft into full device takeover. The malware reportedly targets 217 banking and cryptocurrency applications and supports 137 remote commands, giving attackers extensive control over an infected Android phone. Its capabilities include stealing lock-screen credentials, intercepting SMS messages, recording keystrokes, capturing screenshots, manipulating clipboard content, disabling Google Play Protect, and redirecting cryptocurrency transactions. 

The malware is distributed through malicious websites that imitate popular applications such as TikTok and Google Chrome. Victims are initially persuaded to install a dropper disguised as Google Play Protect. That disguise is especially effective because users may interpret its permission requests as legitimate security activity rather than the beginning of an infection. Once installed, the malware pressures the victim into granting Android Accessibility permissions and can subsequently disable the genuine Play Protect service. 

The abuse of Accessibility Services is central to the attack. These services are designed to help users interact with their devices, but they can also provide malware with the ability to observe screen content, perform actions, capture information and control applications. Once Rokarolla obtains this access, it can interact with the device almost as if the attacker were physically operating it.

Rokarolla uses overlay attacks to steal banking and cryptocurrency credentials. It downloads fake HTML login pages corresponding to targeted applications and stores them locally. When the victim opens a legitimate banking or wallet application, the malware places a convincing counterfeit login screen over the real application. Credentials, payment-card information and other details entered by the user are then captured by the attackers. 

The same overlay technique can imitate the Android lock screen and capture the victim’s PIN, password or unlock pattern. This allows attackers to retain control of the device even when it is locked and weakens one of the main protections users depend upon to secure financial applications.

The malware can read all SMS messages and send messages from the compromised device. This enables it to intercept one-time passwords and transaction verification codes used by banks and digital services. By making itself the default application for calls and messages, Rokarolla may also block incoming calls, potentially preventing a bank or fraud-response team from warning the victim about suspicious transactions. 

This capability shows why SMS-based authentication should not be treated as a complete defence against mobile banking malware. When the attacker controls the same device receiving the credentials, authentication code and transaction notification, multiple security layers effectively collapse into a single compromised endpoint.

Rokarolla also includes keylogging and screen-logging functions that allow it to record what the victim types and views. It can collect contacts, notifications and other information that may be used for fraud, impersonation or further social-engineering attacks.

For cryptocurrency users, one of the most dangerous features is clipboard manipulation. When a victim copies a wallet address, the malware can silently replace it with an address controlled by the attacker. Because cryptocurrency addresses are long and difficult to verify visually, the victim may complete the transaction without noticing the substitution. Once confirmed on the blockchain, such transfers are generally difficult or impossible to reverse.

Rather than relying on conventional screen-casting mechanisms that may display a visible recording notification, Rokarolla reportedly uses Accessibility permissions to capture screenshots. The images are compressed and transmitted individually to the attacker, allowing device activity to be monitored without the more obvious indicators associated with live screen sharing. 

The malware also uses multiple command-and-control domains and can receive updated server addresses from its operators. This provides resilience against infrastructure disruption because blocking or taking down a single domain may not terminate communication with infected devices.

For enterprises, Rokarolla should not be viewed only as a consumer banking threat. Employees increasingly use mobile devices for business email, authentication applications, collaboration platforms, cloud services, VPN access and password recovery. A compromised personal or corporate Android device can expose both financial information and enterprise credentials.

Bring-your-own-device environments are particularly vulnerable when organizations cannot verify device integrity, application sources or security configurations. An employee whose phone has been compromised may unknowingly provide attackers with access to corporate email, internal applications, MFA codes, confidential messages or customer information.

Organizations should implement mobile device management or mobile threat defence capabilities for devices accessing sensitive business resources. Devices should be checked for suspicious applications, unsafe configurations, disabled Play Protect, excessive Accessibility permissions, unexpected default SMS applications and connections to known malicious infrastructure.

Access to critical corporate systems should be conditional on device security posture. A device with disabled security controls, outdated software, unknown applications or signs of compromise should not be permitted to access sensitive applications merely because the user entered valid credentials.

Security teams should also monitor authentication activity for unusual locations, new devices, rapid changes in access patterns and repeated use of intercepted verification codes. Where available, organizations should prefer phishing-resistant authentication, hardware-backed credentials or passkeys rather than depending solely on SMS-based one-time passwords.

For individual users, applications should only be installed from trusted sources such as Google Play. Requests to download popular applications through websites, advertisements, messages or unofficial stores should be treated as suspicious. A security application distributed outside the official store and asking for extensive permissions is not reassuring; it is malware wearing a security uniform.

Unexpected Accessibility permission requests are an especially important warning sign. Banking apps, social-media applications, media players and supposed security tools generally should not require unrestricted control over screen content and user actions. Users should review which applications have Accessibility access and remove permissions that are not clearly necessary.

Google Play Protect should remain enabled, and any application attempting to disable it should be treated as malicious. Users should also avoid granting an unfamiliar application permission to become the default SMS, calling or device-administration application.

Banking and cryptocurrency users should verify transaction details independently before approval. Cryptocurrency wallet addresses should be checked at both the beginning and end, and high-value transfers should first be tested using a small amount. Transaction alerts should ideally be delivered through more than one channel so that malware on a single device cannot suppress every warning.

If Rokarolla or similar malware is suspected, the affected device should be disconnected from networks and no longer used for banking, cryptocurrency or corporate access. Banking providers, cryptocurrency exchanges and the organization’s security team should be notified immediately. Passwords and access credentials should be changed from a separate trusted device, and exposed sessions and tokens should be revoked.

A factory reset may be required to remove the malware reliably, followed by installation of applications only from trusted sources. Restoring every application and setting from an unverified backup risks reintroducing the same problem, a remarkably efficient way to repeat an unpleasant afternoon.

The larger lesson from Rokarolla is that mobile security cannot depend solely on app-store controls or a single antivirus layer. Attackers increasingly combine social engineering, fake applications, Accessibility abuse, credential overlays, SMS interception and financial manipulation into one coordinated attack chain.

Effective protection requires secure application installation, permission control, mobile threat detection, strong authentication, transaction monitoring, network visibility and user awareness working together. Once attackers gain control over the device used for banking and authentication, they can observe both the security challenge and the user’s response. Rokarolla shows that the mobile phone is no longer merely a communication device; it is an identity wallet, authentication token and financial terminal, which makes it an exceptionally valuable target.

Security researchers at Zimperium's zLabs have documented a new Android banking trojan, Rokarolla, that targets 217 banking and cryptocurrency apps and packs 137 remote commands. Together, they give an operator near-total control of an infected phone: it lifts lock-screen PINs, reads and sends SMS, rewrites the clipboard to redirect crypto payments, and switches off Google Play

Source: New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds via The Hacker News — published 16 Jun 2026.