Malware & Tooling · Credential Theft
Rokarolla now silences bank alerts too Rokarolla has moved past simple credential theft. Once it wins Accessibility, SMS, and notification access, it can read what the user sees, grab one-time codes, and shut down the calls and alerts that would normally warn a victim during fraud.
Zimperium says the trojan targets 217 banking and crypto apps and can execute 137 commands. It also blocks incoming calls, suppresses device audio, shows fraudulent overlays, and deactivates Google Play Protect, which makes the handset itself part of the fraud path.
That breaks the assumption that SMS OTPs and phone-based fraud alerts will interrupt a bad transaction. The same Android device can now feed the attacker codes and stay quiet at the exact moment the bank tries to get the user’s attention.
6 sources · Jun 18
Timeline Sources Jun 18 SecurityWeek
Rokarolla Banking Trojan Targets 200 Applications
The Android malware allows its operators to take control of infected devices and harvest sensitive information.
original Jun 17 Help Net Security
Rokarolla Android trojan targets banking and crypto users, enables device takeover - Help Net Security
Rokarolla, a newly discovered Android banking trojan, uses phishing overlays and SMS theft to target financial apps.
original Jun 16 The Hacker News
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds
Rokarolla targets 217 banking and crypto apps with 137 commands, enabling PIN, SMS code, and crypto payment theft.
original Part of the PlainSec briefing for 2026-06-16
Every edition of this story: Rokarolla now silences bank alerts too
More from today Malware & Tooling · Credential Theft
Rokarolla now silences bank alerts too Rokarolla has moved past simple credential theft. Once it wins Accessibility, SMS, and notification access, it can read what the user sees, grab one-time codes, and shut down the calls and alerts that would normally warn a victim during fraud.
Zimperium says the trojan targets 217 banking and crypto apps and can execute 137 commands. It also blocks incoming calls, suppresses device audio, shows fraudulent overlays, and deactivates Google Play Protect, which makes the handset itself part of the fraud path.
That breaks the assumption that SMS OTPs and phone-based fraud alerts will interrupt a bad transaction. The same Android device can now feed the attacker codes and stay quiet at the exact moment the bank tries to get the user’s attention.
6 sources · Jun 18
Timeline Sources Jun 18 SecurityWeek
Rokarolla Banking Trojan Targets 200 Applications
The Android malware allows its operators to take control of infected devices and harvest sensitive information.
original Jun 17 Help Net Security
Rokarolla Android trojan targets banking and crypto users, enables device takeover - Help Net Security
Rokarolla, a newly discovered Android banking trojan, uses phishing overlays and SMS theft to target financial apps.
original Jun 16 The Hacker News
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds
Rokarolla targets 217 banking and crypto apps with 137 commands, enabling PIN, SMS code, and crypto payment theft.
original Part of the PlainSec briefing for 2026-06-16
Every edition of this story: Rokarolla now silences bank alerts too
More from today