Rokarolla Android trojan steals PINs, SMS codes, and crypto wallet funds

The Hacker News reports today that Zimperium's zLabs has detailed Rokarolla, a new Android banking trojan that steals lock-screen PINs, intercepts SMS codes, and siphons crypto wallet funds. The malware targets 217 banking and cryptocurrency apps and comes with 137 remote commands, according to the researchers, giving attackers near-total control of infected devices. Zimperium says those controls let an operator unlock devices, read and send SMS, and move money by hijacking transactions.

The Hacker News adds it can rewrite the clipboard to redirect crypto payments and disable Google Play protections. Zimperium notes the operator can read and send SMS and lift device PINs, widening the paths to account takeover. Watch for Google, antivirus vendors, and banks to roll out detections, Play Protect updates, and account safeguards as indicators and samples emerge. [Developing. This article will be updated.]