[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNDvEp3m4KhhdimeJ3KYBHkDmpYiWd3sLGcVIYuq_Pzc":3},{"article":4,"iocs":43,"watch_terms":47,"solutions":48,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"23e7bfef-bf8c-4bc6-9304-3247b3f92232","New Rokarolla Android malware targets 217 banking, crypto apps","new-rokarolla-android-malware-targets-217-banking-crypto-apps-056197","A new Android banking trojan named Rokarolla is targeting 217 banking and cryptocurrency applications using an extensive set of 137 commands. [...]","A new Android banking trojan called Rokarolla is distributing via malicious websites disguised as app updates for Chrome and TikTok. It steals credentials, contact lists, and SMS data, and can take administrative control of devices. Rokarolla targets 217 banking and cryptocurrency apps by displaying fake login overlays to harvest financial information.","New Rokarolla Android malware targets 217 banking and crypto apps via malicious websites.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-rokarolla-android-malware-targets-217-banking-crypto-apps\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F01\u002F31\u002Fimage_(2).jpg","2026-06-16T20:04:11+00:00","2026-06-16T22:00:25.630343+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Chrome","product",{"name":21,"type":19},"TikTok",{"name":23,"type":24},"Android","technology",{"name":26,"type":27},"Google","vendor",{"name":29,"type":27},"Zimperium","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,38],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":34,"value":45,"context":46},"Rokarolla","Name of the new Android banking trojan.",[26,29,18],{"controls":49,"vendors":126},[50,71,97],{"slug":51,"name":52,"problem":53,"products":54},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[55,63],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":72,"name":73,"problem":74,"products":75},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[76,84,89],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":85,"product_name":86,"url":87,"description":88},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":98,"name":99,"problem":100,"products":101},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":141},"rokarolla-android-trojan-harvests-banking-credentials-via-fake-app-updates","Rokarolla Android Trojan Harvests Banking Credentials via Fake App Updates","Rokarolla spreads by impersonating legitimate app updates for trusted platforms like Chrome and TikTok on malicious websites, exploiting users' trust in familiar brand names. Once installed, it abuses Android's device administrator privileges to gain persistent control, making removal difficult and enabling broad data theft including SMS, contacts, and financial credentials. The use of fake login overlays (overlay attacks) targeting 217 banking and crypto apps means victims unknowingly hand over their most sensitive financial credentials. This attack demonstrates that social engineering combined with mobile privilege abuse remains a highly effective and dangerous threat vector, particularly as users increasingly manage finances on mobile devices.",[132,133,134,135,136,137,138,139,140],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-163: Vetting the Security of Mobile Applications","NIST AC-2: Account Management","NIST IA-5: Authenticator Management (MFA)","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","GDPR Article 32: Security of Processing (protection of personal\u002Ffinancial data)","ITIL: Service Configuration Management (MDM policy enforcement)",{}]