New Rokarolla Android malware targets 217 banking, crypto apps

Rokarolla spreads by impersonating legitimate app updates for trusted platforms like Chrome and TikTok on malicious websites, exploiting users' trust in familiar brand names. Once installed, it abuses Android's device administrator privileges to gain persistent control, making removal difficult and enabling broad data theft including SMS, contacts, and financial credentials. The use of fake login overlays (overlay attacks) targeting 217 banking and crypto apps means victims unknowingly hand over their most sensitive financial credentials. This attack demonstrates that social engineering combined with mobile privilege abuse remains a highly effective and dangerous threat vector, particularly as users increasingly manage finances on mobile devices.